In my dashboard, the second panel depends on the output of the first one. Can someone please help me with the use of tokens to capture the result of the first panel and passes that value to the second one which then starts running.
Thanks a lot in advance! 🙂
Do you want something like this:
<dashboard> <row> <panel> <table> <title>Event counts by sourcetype</title> <search> <query>index=_internal | stats count by sourcetype</query> </search> <drilldown> <set token="show_panel">true</set> <set token="selected_value">$click.value$</set> </drilldown> </table> </panel> <panel depends="$show_panel$"> <event> <title>Recent events for $selected_value$</title> <search> <query>index=_internal sourcetype=$selected_value$ </query> <earliest>$earliest$</earliest> <latest>$latest$</latest> </search> <option name="count">5</option> </event> </panel> </row> </dashboard>
Refer this accepted answer:
Also refer this doc:
Let me know if this helps!!
If you want the second panel to run immediately after the first panel returns search results (without a user clicking on anything), you are able to access search job properties or named fields in the first row of search results, as documented in the search event handlers guide.
If, for example, you'd like the second panel to run only if the number of results from the first panel was >5, then you could use the following structure in the code for the search in your first panel:
<search>... <done> <condition match="$job.resultCount$ > 5"> <set token="show_panel">true</set> </condition> <condition> <unset token="show_panel"/> </condition> </done> </search>
And then the second panel would need to use a
depends clause to rely on that token in order to display:
<panel depends="$show_panel$> ... </panel>
Hi elliotproebstel, your solution is working as expected. Thanks for the solution.
There is one problem I am facing in this regard.
actually, I am creating a model in the first panel and then showing it's properties in the second one. Earlier both the panels were running at the same time hence the second one was throwing an error that the model doesn't exist.
Now as both the panels are running one by one then it should not through this error as of my understanding.
Can you please help with passing the model name as a token to the new panel to avoid this error message.
Thanks for your support 🙂
If your first panel returns a single row of results and one field from that row is called
model_name, and you'd like to pass that to the second panel, then the code above would change to this:
<search>... <done> <condition match="$job.resultCount$ > 1"> <set token="show_panel">true</set> <set token="model_name">$result.model_name|s$</set> </condition> <condition> <unset token="show_panel"/> </condition> </done> </search>
And then in your second panel's query, you'd reference
model_name like this:
index=something sourecetype=blah model="$model_name$"
Can you please help me with one of my previous question labelled "TRANSFORMING TABLES"
I need to join 2 tables without a common field.
All rows of 1st table must join with all the rows of the second one.
I have also illustrated an example in that question's description.
Also link is also given below-