Dashboards & Visualizations

drilldown condition set token based on click.value

neluvasilica
Explorer

I currently have a drill down dashboard which sets tokens depending on the $click.value$.

<drilldown>
          <condition match="$click.value$ != &quot;(master)&quot;">
            <set token="non_master">$click.value$</set>
            <unset token="master"></unset>
          </condition>
          <condition match="$click.value$ = &quot;(master)&quot;">
            <set token="master">$click.value$</set>
            <unset token="non_master"></unset>
          </condition>
</drilldown>

I would want to add another condition which would set a token if $click.value$ contains a specific string, let's say "bla". I have tried using like and match but without success.
Any suggestion on how can I achieve this?

0 Karma
1 Solution

vnravikumar
Champion

Hi

Check this

<dashboard>
  <label>drilldown</label>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults 
| eval temp="(master), abc-bla-01, abc-foo-01, abc-bla-02,abc-foo-02,abcd002" 
| makemv delim="," temp 
| eval temp =trim(temp) 
| mvexpand temp</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="count">10</option>
        <option name="drilldown">cell</option>
        <drilldown>
          <condition match="like('row.temp',&quot;%bla%&quot;)">
            <set token="showbla">true</set>
            <unset token="showmaster"></unset>
            <unset token="shownonmaster"></unset>
          </condition>
          <condition match="'row.temp'== &quot;(master)&quot;">
            <set token="showmaster">true</set>
            <unset token="showbla"></unset>
            <unset token="shownonmaster"></unset>
          </condition>
          <condition match="'row.temp'!= &quot;master&quot;">
            <set token="shownonmaster">true</set>
            <unset token="showbla"></unset>
            <unset token="showmaster"></unset>
          </condition>
        </drilldown>
      </table>
    </panel>
  </row>
  <row>
    <table>
      <title>showbla- $showbla$ showmaster - $showmaster$ shownonmaster - $shownonmaster$</title>
    </table>
  </row>
</dashboard>

View solution in original post

vnravikumar
Champion

Hi

Check this

<dashboard>
  <label>drilldown</label>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults 
| eval temp="(master), abc-bla-01, abc-foo-01, abc-bla-02,abc-foo-02,abcd002" 
| makemv delim="," temp 
| eval temp =trim(temp) 
| mvexpand temp</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="count">10</option>
        <option name="drilldown">cell</option>
        <drilldown>
          <condition match="like('row.temp',&quot;%bla%&quot;)">
            <set token="showbla">true</set>
            <unset token="showmaster"></unset>
            <unset token="shownonmaster"></unset>
          </condition>
          <condition match="'row.temp'== &quot;(master)&quot;">
            <set token="showmaster">true</set>
            <unset token="showbla"></unset>
            <unset token="shownonmaster"></unset>
          </condition>
          <condition match="'row.temp'!= &quot;master&quot;">
            <set token="shownonmaster">true</set>
            <unset token="showbla"></unset>
            <unset token="showmaster"></unset>
          </condition>
        </drilldown>
      </table>
    </panel>
  </row>
  <row>
    <table>
      <title>showbla- $showbla$ showmaster - $showmaster$ shownonmaster - $shownonmaster$</title>
    </table>
  </row>
</dashboard>

neluvasilica
Explorer

that worked! thank you!

0 Karma

spavin
Path Finder

Hi @neluvasilica,

What you have so far is:

  • If you click on a row that starts with "(master)" then $master$ is set and $non_master$ is unset
  • If you click on a row that doesn't start with "(master)" then $master$ is unset and $non_master$ is set

The order of the conditions is important. If you want to match another option - eg "bla" then you'll need to check for that before you do the click.value != "(master)" check - because that will match everything that's not "(master)" and the processing will stop there.

Try this order:

<drilldown>
           <condition match="$click.value$ = &quot;bla&quot;">
             <set token="bla">$click.value$</set>
             <unset token="non_master"></unset>
             <unset token="master"></unset>
           </condition>
           <condition match="$click.value$ = &quot;(master)&quot;">
             <set token="master">$click.value$</set>
             <unset token="non_master"></unset>
             <unset token="blah"
           </condition>
           <condition match="$click.value$ != &quot;(master)&quot;">
             <set token="non_master">$click.value$</set>
             <unset token="master"></unset>
             <unset token="bla"></unset>
           </condition>
 </drilldown>

If you want a generic catch-all condition to set $non_master$, you can simply put <conditon>...</conditon> as the last block. It will only match if none of the other conditions matched.

I assumed you also wanted a token $bla$ created - if not, just set master / non_master to suit your needs when it matches bla.

Cheers,
Daniel

0 Karma

neluvasilica
Explorer

Hi @spavin,
Thanks for pointing the order out. That helps.
However it seems to me the matching condition applies to exact match only. So for instance if I have a graph with several values like: (master), abc-bla-01, abc-foo-01, abc-bla-02,abc-foo-02,abcd002, I'd like the following behavior.

  • clicking on (master) displays a new panel specific to (master)
  • clicking on any value containing "bla" displays a different panel specific to bla and hides the (master) panel
  • clicking on any other value apart from (master) and values containing "bla" hides the panels above and displays something new.

The condition match for "bla" works as long as I type in the full value but I was not able to create a condition match which would capture any click.value containing that string.
Thanks,
Nelu

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...