Dashboards & Visualizations

Show/Hide a table depending on a column value from another table

sdhawanx
Path Finder

I have table with just 2 columns 'Name' and 'Value'. one of the rows has the 'Value' as 'Fail', 'Pass' or 'NA'

I have another table, which has a bunch of related data. I have 2 options for the second table:-

1. I want the query for table 2 to run only when the 'Value' in the first table is 'Fail' and the table 2 to remain hidden

OR

2. but I want that table to be only displayed when the 'Value' in the first table is 'Fail'

Labels (2)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@sdhawanx 

 

Can you please try this xml?

<form>
  <label>Table Depend</label>
  <row>
    <panel>
      <table>
        <title>First Table</title>
        <search>
          <query>| makeresults | eval val="Fail,Pass,NA", val=split(val,",") | mvexpand val</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">cell</option>
        <option name="refresh.display">progressbar</option>
        <drilldown>
          <condition match="match($row.val$, &quot;Fail&quot;)">
            <set token="tkn_value">$row.val$</set>
          </condition>
          <condition>
            <unset token="tkn_value" />
          </condition>
        </drilldown>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <table depends="$tkn_value$">
        <title>Second Table with value $tkn_value$</title>
        <search>
          <query>| makeresults | eval val="Fail,Pass,NA", val=split(val,",") | mvexpand val | where val="$tkn_value$"</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</form>
0 Karma

sdhawanx
Path Finder

i added this portion to my simple xml file in the first table

<drilldown>
          <condition match="match($row.val$, &quot;Fail&quot;)">
            <set token="tkn_value">$row.val$</set>
          </condition>
          <condition>
            <unset token="tkn_value" />
          </condition>
</drilldown>

  and then 

 <table depends="$tkn_value$">

 the above portion in the second table. but the second table always remains hidden for some reason no matter what the value is. 

Note:- i changed the row.val as per my table requirement still its the same result. 

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@sdhawanx 

 

Is it possible for you to share sample XML of both table.. replace search with dummy search.

0 Karma

sdhawanx
Path Finder

Table 1
<table id="Table_1">
<title>Table 1</title>
<search id="Table_1">
<query>| makeresults | eval val="Fail,Pass,NA", val=split(val,",") | mvexpand val</query>
<earliest>$earliest$</earliest>
<latest>$latest$</latest>
</search>
<option name="count">100</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<drilldown>
<condition match="match($row.val$, &quot;Fail&quot;)">
<set token="tkn_value">$row.val$</set>
</condition>
<condition>
<unset token="tkn_value" />
</condition>
</drilldown>
<format type="color" field="Log">
<colorPalette type="list">[#FFFFFF,#DC4E41]</colorPalette>
<scale type="threshold">1</scale>
</format>
</table>

Table 2

<table id="Table_2" depends="$tkn_value$">
<title>Table 2</title>
<search id="base_search_35_1">
<query>
| makeresults | eval val="Fail,Pass,NA", val=split(val,",") | mvexpand val | where val="$tkn_value$" </query>
</search>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@sdhawanx  Your code looks good and working in my instance also. Anything else you did with table drill down? 

0 Karma

sdhawanx
Path Finder

there is nothing else in the code apart from the changed query 

for the second table i used only this part

| makeresults | eval val="Fail,Pass,NA", val=split(val,",") | mvexpand val 

and removed the last pipe. this is the only difference. But as per my understanding the code should still work fine. but the table remains hidden nonetheless.

i created a sample code on my local splunk and copied your code as is and it seemed to work just fine but when transferring it to the main code its not working

 

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@sdhawanx 

Can you please check the token value by printing it? Just do below changes.

<drilldown>
    <condition match="match($row.value$, &quot;Fail&quot;)">
      <set token="tkn_value">$row.value$</set>
      <unset token="tkn_value_tmp" />
    </condition>
    <condition>
      <unset token="tkn_value" />
      <set token="tkn_value_tmp">$row.value$ Negative</set>
    </condition>
  </drilldown>

 

Add below

<row>
    <panel>
      <html>$tkn_value$<br />
      $tkn_value_tmp$</html>
    </panel>
  </row>

 

Just observe the behaviour of both token. It will help you to debug more.

 

0 Karma

sdhawanx
Path Finder

I will test this once i return to work. Thanks for the prompt response. Very much appreciated

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...