Re: Two depends for the same panel

ebruozys · ‎03-24-2021

Hi all,

I'm trying to get two depends in for one panel. I created a Link Switcher based on the code used in Splunk Dashboard Examples. Whenever I click on one of the links I want to see the results filtered for it, but only if there are results available otherwise I want the panel to be hidden.

This is what I got so far, but this only works for the Link Switcher part.

<form theme="dark">
<label>Hidden panel</label>
<search id="base">
<query>(index=dummy...not important for this case)</query><earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>
<fieldset submitButton="false">
<input type="time" token="field1">
<label>Period</label>
<default>
<earliest>-24h@h</earliest>
<latest>now</latest>
</default>
</input>
<input type="link" token="unused">
<label>Chose a view</label>
<choice value="info">Info</choice>
<choice value="exception">Exception</choice>
<default>Table</default>
<change>
<condition value="info">
<set token="showInfo">true</set>
<unset token="showException"></unset>
</condition>
<condition value="exception">
<set token="showException">true</set>
<unset token="showInfo"></unset>
</condition>

</change>

<row>
<panel>
<table depends="$showException$, $showPanel$">
<title>Exceptions</title>
<search base="base">
<query>| where ....not relevant"</query>
<progress>
<condition match="'job.resultCount' < 0">
<set token="showPanel">true</set>
</condition>
<condition>
<unset token="showPanel"></unset>
</condition>
</progress>
</search>
<option name="drilldown">none</option>
</table>
</panel>
</row>

bowesmana · ‎03-24-2021

NB: Your pasted XML was not complete, so it needed patching to get working - please use the code sample button to embed dashboard XML

Your <progress> logic is wrong I suspect - you are testing job.resultCount LESS_THAN 0 to cause the set the showPanel token. If you change that to > 0 (>) then it works.

See this (I added an extra row to show the data)

<form theme="dark">
  <label>Hidden panel</label>
  <search id="base">
    <query>| makeresults</query>
    <earliest>$field1.earliest$</earliest>
    <latest>$field1.latest$</latest>
  </search>
  <fieldset submitButton="false">
    <input type="time" token="field1">
      <label>Period</label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
    <input type="link" token="unused">
      <label>Chose a view</label>
      <choice value="info">Info</choice>
      <choice value="exception">Exception</choice>
      <default>Table</default>
      <change>
        <condition value="info">
          <set token="showInfo">true</set>
          <unset token="showException"></unset>
        </condition>
        <condition value="exception">
          <set token="showException">true</set>
          <unset token="showInfo"></unset>
        </condition>
      </change>
    </input>  
  </fieldset>
  <row>
    <panel>
      <table depends="$showException$, $showPanel$">
        <title>Exceptions</title>
        <search base="base">
          <query></query>
          <progress>
            <condition match="'job.resultCount' &gt; 0">
              <set token="showPanel">true</set>
            </condition>
            <condition>
              <unset token="showPanel"></unset>
            </condition>
          </progress>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <html>
        table depends="$showException$, $showPanel$"
      </html>
    </panel>
    <panel>
      <table>
        <title>Exceptions</title>
        <search base="base">
          <query></query>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</form>

Two depends for the same panel

panel

simple XML

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Automating Threat Operations and Threat Hunting with Recorded Future

Keep the Learning Going with the New Best of .conf Hub

Splunk Community Badges!

Join the Conversation