Hello,
I have a 4 servers A, B C, & D. These servers points to two different DS.
A & B points to US DS server, C & D servers points to UK DS Server.
I'm selecting these 4 servers in an multiselect value and it has to show two different panels. (hide initially)
But, If i select only A & B it has show only US DS panel. (I don't want to show the DS values in the input values.
Basically what I'm looking for is, I have a Multi Select Server input, if i select 5 servers which are belongs to 3 goes to US and 2 go to UK, I want it to have two panels. The US panel shows the clients (3 total). Whereas UK panel shows the identical thing, but only the 2 clients
How do I achieve this ?
<form version="1.1" theme="light">
<label>two DS panels</label>
<fieldset submitButton="false">
<input type="multiselect" token="server">
<label>Server</label>
<choice value="a">A</choice>
<choice value="b">B</choice>
<choice value="c">C</choice>
<choice value="d">D</choice>
</input>
</fieldset>
<row>
<panel>
<table>
<title>US DS</title>
<search>
<query>| makeresults format=csv data="Host, DS
A, US-DS
B, US-DS"
| table Host DS</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
<panel>
<table>
<title>UK DS</title>
<search>
<query>| makeresults format=csv data="Host, DS
C, UK-DS
D, UK-DS"
| table Host DS</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
</form>
You should take panel depends on use based on those servers which you have selected.
Something like
...
<fieldset ...>
<input type="multiselect" ...
<change>
<condition value="Server A">
<set token="t_US_DS">
....
</fieldset>
...
<panel depends="$t_US_DS$">
.....
</panel>
I suppose that you will get the idea from above and you can get the details from visualization docs.splunk.com. As you probably have dynamic list of nodes you probably need to do this using lookups with eval in coditions?