Dashboards & Visualizations

drilldown condition set token based on click.value

neluvasilica
Explorer

I currently have a drill down dashboard which sets tokens depending on the $click.value$.

<drilldown>
          <condition match="$click.value$ != &quot;(master)&quot;">
            <set token="non_master">$click.value$</set>
            <unset token="master"></unset>
          </condition>
          <condition match="$click.value$ = &quot;(master)&quot;">
            <set token="master">$click.value$</set>
            <unset token="non_master"></unset>
          </condition>
</drilldown>

I would want to add another condition which would set a token if $click.value$ contains a specific string, let's say "bla". I have tried using like and match but without success.
Any suggestion on how can I achieve this?

0 Karma
1 Solution

vnravikumar
Champion

Hi

Check this

<dashboard>
  <label>drilldown</label>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults 
| eval temp="(master), abc-bla-01, abc-foo-01, abc-bla-02,abc-foo-02,abcd002" 
| makemv delim="," temp 
| eval temp =trim(temp) 
| mvexpand temp</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="count">10</option>
        <option name="drilldown">cell</option>
        <drilldown>
          <condition match="like('row.temp',&quot;%bla%&quot;)">
            <set token="showbla">true</set>
            <unset token="showmaster"></unset>
            <unset token="shownonmaster"></unset>
          </condition>
          <condition match="'row.temp'== &quot;(master)&quot;">
            <set token="showmaster">true</set>
            <unset token="showbla"></unset>
            <unset token="shownonmaster"></unset>
          </condition>
          <condition match="'row.temp'!= &quot;master&quot;">
            <set token="shownonmaster">true</set>
            <unset token="showbla"></unset>
            <unset token="showmaster"></unset>
          </condition>
        </drilldown>
      </table>
    </panel>
  </row>
  <row>
    <table>
      <title>showbla- $showbla$ showmaster - $showmaster$ shownonmaster - $shownonmaster$</title>
    </table>
  </row>
</dashboard>

View solution in original post

vnravikumar
Champion

Hi

Check this

<dashboard>
  <label>drilldown</label>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults 
| eval temp="(master), abc-bla-01, abc-foo-01, abc-bla-02,abc-foo-02,abcd002" 
| makemv delim="," temp 
| eval temp =trim(temp) 
| mvexpand temp</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="count">10</option>
        <option name="drilldown">cell</option>
        <drilldown>
          <condition match="like('row.temp',&quot;%bla%&quot;)">
            <set token="showbla">true</set>
            <unset token="showmaster"></unset>
            <unset token="shownonmaster"></unset>
          </condition>
          <condition match="'row.temp'== &quot;(master)&quot;">
            <set token="showmaster">true</set>
            <unset token="showbla"></unset>
            <unset token="shownonmaster"></unset>
          </condition>
          <condition match="'row.temp'!= &quot;master&quot;">
            <set token="shownonmaster">true</set>
            <unset token="showbla"></unset>
            <unset token="showmaster"></unset>
          </condition>
        </drilldown>
      </table>
    </panel>
  </row>
  <row>
    <table>
      <title>showbla- $showbla$ showmaster - $showmaster$ shownonmaster - $shownonmaster$</title>
    </table>
  </row>
</dashboard>

neluvasilica
Explorer

that worked! thank you!

0 Karma

spavin
Path Finder

Hi @neluvasilica,

What you have so far is:

  • If you click on a row that starts with "(master)" then $master$ is set and $non_master$ is unset
  • If you click on a row that doesn't start with "(master)" then $master$ is unset and $non_master$ is set

The order of the conditions is important. If you want to match another option - eg "bla" then you'll need to check for that before you do the click.value != "(master)" check - because that will match everything that's not "(master)" and the processing will stop there.

Try this order:

<drilldown>
           <condition match="$click.value$ = &quot;bla&quot;">
             <set token="bla">$click.value$</set>
             <unset token="non_master"></unset>
             <unset token="master"></unset>
           </condition>
           <condition match="$click.value$ = &quot;(master)&quot;">
             <set token="master">$click.value$</set>
             <unset token="non_master"></unset>
             <unset token="blah"
           </condition>
           <condition match="$click.value$ != &quot;(master)&quot;">
             <set token="non_master">$click.value$</set>
             <unset token="master"></unset>
             <unset token="bla"></unset>
           </condition>
 </drilldown>

If you want a generic catch-all condition to set $non_master$, you can simply put <conditon>...</conditon> as the last block. It will only match if none of the other conditions matched.

I assumed you also wanted a token $bla$ created - if not, just set master / non_master to suit your needs when it matches bla.

Cheers,
Daniel

0 Karma

neluvasilica
Explorer

Hi @spavin,
Thanks for pointing the order out. That helps.
However it seems to me the matching condition applies to exact match only. So for instance if I have a graph with several values like: (master), abc-bla-01, abc-foo-01, abc-bla-02,abc-foo-02,abcd002, I'd like the following behavior.

  • clicking on (master) displays a new panel specific to (master)
  • clicking on any value containing "bla" displays a different panel specific to bla and hides the (master) panel
  • clicking on any other value apart from (master) and values containing "bla" hides the panels above and displays something new.

The condition match for "bla" works as long as I type in the full value but I was not able to create a condition match which would capture any click.value containing that string.
Thanks,
Nelu

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...