Two depends for the same panel

ebruozys · ‎03-24-2021

Hi all,

I'm trying to get two depends in for one panel. I created a Link Switcher based on the code used in Splunk Dashboard Examples. Whenever I click on one of the links I want to see the results filtered for it, but only if there are results available otherwise I want the panel to be hidden.

This is what I got so far, but this only works for the Link Switcher part.

<form theme="dark">
<label>Hidden panel</label>
<search id="base">
<query>(index=dummy...not important for this case)</query><earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>
<fieldset submitButton="false">
<input type="time" token="field1">
<label>Period</label>
<default>
<earliest>-24h@h</earliest>
<latest>now</latest>
</default>
</input>
<input type="link" token="unused">
<label>Chose a view</label>
<choice value="info">Info</choice>
<choice value="exception">Exception</choice>
<default>Table</default>
<change>
<condition value="info">
<set token="showInfo">true</set>
<unset token="showException"></unset>
</condition>
<condition value="exception">
<set token="showException">true</set>
<unset token="showInfo"></unset>
</condition>

</change>

<row>
<panel>
<table depends="$showException$, $showPanel$">
<title>Exceptions</title>
<search base="base">
<query>| where ....not relevant"</query>
<progress>
<condition match="'job.resultCount' < 0">
<set token="showPanel">true</set>
</condition>
<condition>
<unset token="showPanel"></unset>
</condition>
</progress>
</search>
<option name="drilldown">none</option>
</table>
</panel>
</row>

bowesmana · ‎03-24-2021

NB: Your pasted XML was not complete, so it needed patching to get working - please use the code sample button to embed dashboard XML

Your <progress> logic is wrong I suspect - you are testing job.resultCount LESS_THAN 0 to cause the set the showPanel token. If you change that to > 0 (>) then it works.

See this (I added an extra row to show the data)

<form theme="dark">
  <label>Hidden panel</label>
  <search id="base">
    <query>| makeresults</query>
    <earliest>$field1.earliest$</earliest>
    <latest>$field1.latest$</latest>
  </search>
  <fieldset submitButton="false">
    <input type="time" token="field1">
      <label>Period</label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
    <input type="link" token="unused">
      <label>Chose a view</label>
      <choice value="info">Info</choice>
      <choice value="exception">Exception</choice>
      <default>Table</default>
      <change>
        <condition value="info">
          <set token="showInfo">true</set>
          <unset token="showException"></unset>
        </condition>
        <condition value="exception">
          <set token="showException">true</set>
          <unset token="showInfo"></unset>
        </condition>
      </change>
    </input>  
  </fieldset>
  <row>
    <panel>
      <table depends="$showException$, $showPanel$">
        <title>Exceptions</title>
        <search base="base">
          <query></query>
          <progress>
            <condition match="'job.resultCount' &gt; 0">
              <set token="showPanel">true</set>
            </condition>
            <condition>
              <unset token="showPanel"></unset>
            </condition>
          </progress>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <html>
        table depends="$showException$, $showPanel$"
      </html>
    </panel>
    <panel>
      <table>
        <title>Exceptions</title>
        <search base="base">
          <query></query>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</form>

Two depends for the same panel

panel

simple XML

Introducing Splunk Enterprise 9.2

Adoption of RUM and APM at Splunk

Routing logs with Splunk OTel Collector for Kubernetes