Solved: What dashboard condition match options can I use t...

johnansett · ‎06-05-2018

Hey there,

I am trying to set some conditions a number of dashboard panels. In short, I want to report on percentage of storage utlised at multiple locations, I use a drop down box to select the location and it displays the panels. The issue is that some sites have Nutanix storage, some sites have EMC and some have both. I only want to relevant panels to be displayed.

This is what I have currently... in 'kind of' works:

 <title>$location$ NTNX Storage Capacity Used %</title>
<search base="SUMMARY_STORAGE_KPI">
  <query>search Location="$location$"</query>
    <progress>
          <condition match="'job.resultCount' == 0">
            <unset token="hide_panel"></unset>
          </condition>
          <condition>
            <set token="hide_panel">true</set>
          </condition>
    </progress>
</search>
  <html>
   <div class="custom-result-value $ntnx_range$">
     $ntnx_value$
   </div>
  </html>
</panel>
<panel depends="$hide_panel$">
 <title>$location$ VNX Storage Capacity Used %</title>
<search base="SUMMARY_STORAGE_KPI">
  <query>search Location="$location$"</query>
    <progress>
          <condition match="'job.resultCount' == 0">
            <unset token="hide_panel"></unset>
          </condition>
          <condition>
            <set token="hide_panel">true</set>
          </condition>
    </progress>
</search>
  <html>
   <div class="custom-result-value $vnx_range$">
     $vnx_value$
   </div>
  </html>
</panel>

I think the problem is the way the report presents the data, this is the report:

index="summary" Vendor=NTNX 
| bucket span=12h _time 
| stats latest(FreeMB) AS NTNXFreeMB, latest(TotalCapacityMB) AS NTNXTotalCapacityMB, latest(UsedMB) AS NTNXUsedMB, by Location, node
| append
[ search index="summary" Vendor=EMC System=VNX 
| bucket span=12h _time 
| stats latest(FreeMB) AS VNXFreeMB, latest(TotalCapacityMB) AS VNXTotalCapacityMB, latest(UsedMB) AS VNXUsedMB, by Location, node, name]
| stats sum(NTNXUsedMB) AS NTNXUsedMB, sum(NTNXTotalCapacityMB) AS NTNXTotalCapacityMB, sum(VNXUsedMB) AS VNXUsedMB, sum(VNXTotalCapacityMB) AS VNXTotalCapacityMB BY Location
| eval NTNX_Capacity=round('NTNXUsedMB'/'NTNXTotalCapacityMB',2)*100
| eval VNX_Capacity=round('VNXUsedMB'/'VNXTotalCapacityMB',2)*100
| rangemap field=NTNX_Capacity low=0-49 elevated=50-79 severe=80-99
| rename range AS NTNX_Capacity_Range
| rangemap field=VNX_Capacity low=0-49 elevated=50-79 severe=80-99
| rename range AS VNX_Capacity_Range

What condition match can I use to hide/unhide depending on the result?

Thanks!!

harishalipaka · ‎06-05-2018

try this

<form>
  <label>condiiton</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="field1">
      <label>QueueType</label>
   <choice value="LogFIle1.log">Merch</choice>
   <choice value="LogFIle2.log">NonMerch</choice>
   <choice value="LogFIle3.log">DonMerch</choice>
   <default>LogFIle1.log</default>
   <initialValue>LogFIle1.log</initialValue>
     <change>
          <condition value="LogFIle1.log">
            <set token="Merch">Merch</set>
            <unset token="NonMerch"></unset>

          </condition>
          <condition >
            <unset token="Merch">Merch</unset>
            <set token="NonMerch">NonMerch</set>

          </condition>

        </change>
    </input>
  </fieldset>
  <row depends="$Merch$">
    <panel>
      <table>
        <title>Table 1 $Merch$</title>
        <search>
          <query>| makeresults 
| eval A=12 
| table _time LogID ENTERPRISE_COMPANY VEHICLE_ID STOREID STOCK_NUMBER STATUS_MESSAGE FAIL_REASON ERROR_MESSAGE</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
  <row depends="$NonMerch$">
    <panel>
      <table>
        <title>Table 2</title>
        <search>
          <query>| makeresults 
| eval A=12 
| table _time LogID INVENTORY_OWNER VEHICLE_ID STOREID STOCK_NUMBER STATUS_MESSAGE FAIL_REASON ERROR_MESSAGE</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</form>

Thanks
Harish

View solution in original post

harishalipaka · ‎06-05-2018

try this

<form>
  <label>condiiton</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="field1">
      <label>QueueType</label>
   <choice value="LogFIle1.log">Merch</choice>
   <choice value="LogFIle2.log">NonMerch</choice>
   <choice value="LogFIle3.log">DonMerch</choice>
   <default>LogFIle1.log</default>
   <initialValue>LogFIle1.log</initialValue>
     <change>
          <condition value="LogFIle1.log">
            <set token="Merch">Merch</set>
            <unset token="NonMerch"></unset>

          </condition>
          <condition >
            <unset token="Merch">Merch</unset>
            <set token="NonMerch">NonMerch</set>

          </condition>

        </change>
    </input>
  </fieldset>
  <row depends="$Merch$">
    <panel>
      <table>
        <title>Table 1 $Merch$</title>
        <search>
          <query>| makeresults 
| eval A=12 
| table _time LogID ENTERPRISE_COMPANY VEHICLE_ID STOREID STOCK_NUMBER STATUS_MESSAGE FAIL_REASON ERROR_MESSAGE</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
  <row depends="$NonMerch$">
    <panel>
      <table>
        <title>Table 2</title>
        <search>
          <query>| makeresults 
| eval A=12 
| table _time LogID INVENTORY_OWNER VEHICLE_ID STOREID STOCK_NUMBER STATUS_MESSAGE FAIL_REASON ERROR_MESSAGE</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</form>

Thanks
Harish

johnansett · ‎06-06-2018

Thanks, I see what you've done there and it worked. Here is my xml for the finished result (which works):

  <change>
       <condition value="Dallas, TX">
         <set token="vnx"></set>
       </condition>
       <condition value="Phoenix, AZ">
         <set token="vnx"></set>
       </condition>
       <condition >
         <unset token="vnx">vnx</unset>
       </condition>
     </change>

</panel>
<panel depends="$vnx$">
 <title>$location$ VNX Storage Capacity Used %</title>
<search base="SUMMARY_STORAGE_KPI">
  <query>search Location="$location$"</query>
    <progress>
      <set token="vnx_value">$result.VNX_Capacity$</set>
      <set token="vnx_range">$result.VNX_Capacity_Range$</set>
    </progress>
</search>
  <html>
   <div class="custom-result-value $vnx_range$">
     $vnx_value$
   </div>
  </html>
</panel>

What dashboard condition match options can I use to hide/unhide depending on the result?

Enterprise Security Content Update (ESCU) | New Releases

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

Index This | What are the 12 Days of Splunk-mas?