Dashboards & Visualizations

drilldown condition set token based on click.value

neluvasilica
Explorer

I currently have a drill down dashboard which sets tokens depending on the $click.value$.

<drilldown>
          <condition match="$click.value$ != &quot;(master)&quot;">
            <set token="non_master">$click.value$</set>
            <unset token="master"></unset>
          </condition>
          <condition match="$click.value$ = &quot;(master)&quot;">
            <set token="master">$click.value$</set>
            <unset token="non_master"></unset>
          </condition>
</drilldown>

I would want to add another condition which would set a token if $click.value$ contains a specific string, let's say "bla". I have tried using like and match but without success.
Any suggestion on how can I achieve this?

0 Karma
1 Solution

vnravikumar
Champion

Hi

Check this

<dashboard>
  <label>drilldown</label>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults 
| eval temp="(master), abc-bla-01, abc-foo-01, abc-bla-02,abc-foo-02,abcd002" 
| makemv delim="," temp 
| eval temp =trim(temp) 
| mvexpand temp</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="count">10</option>
        <option name="drilldown">cell</option>
        <drilldown>
          <condition match="like('row.temp',&quot;%bla%&quot;)">
            <set token="showbla">true</set>
            <unset token="showmaster"></unset>
            <unset token="shownonmaster"></unset>
          </condition>
          <condition match="'row.temp'== &quot;(master)&quot;">
            <set token="showmaster">true</set>
            <unset token="showbla"></unset>
            <unset token="shownonmaster"></unset>
          </condition>
          <condition match="'row.temp'!= &quot;master&quot;">
            <set token="shownonmaster">true</set>
            <unset token="showbla"></unset>
            <unset token="showmaster"></unset>
          </condition>
        </drilldown>
      </table>
    </panel>
  </row>
  <row>
    <table>
      <title>showbla- $showbla$ showmaster - $showmaster$ shownonmaster - $shownonmaster$</title>
    </table>
  </row>
</dashboard>

View solution in original post

vnravikumar
Champion

Hi

Check this

<dashboard>
  <label>drilldown</label>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults 
| eval temp="(master), abc-bla-01, abc-foo-01, abc-bla-02,abc-foo-02,abcd002" 
| makemv delim="," temp 
| eval temp =trim(temp) 
| mvexpand temp</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="count">10</option>
        <option name="drilldown">cell</option>
        <drilldown>
          <condition match="like('row.temp',&quot;%bla%&quot;)">
            <set token="showbla">true</set>
            <unset token="showmaster"></unset>
            <unset token="shownonmaster"></unset>
          </condition>
          <condition match="'row.temp'== &quot;(master)&quot;">
            <set token="showmaster">true</set>
            <unset token="showbla"></unset>
            <unset token="shownonmaster"></unset>
          </condition>
          <condition match="'row.temp'!= &quot;master&quot;">
            <set token="shownonmaster">true</set>
            <unset token="showbla"></unset>
            <unset token="showmaster"></unset>
          </condition>
        </drilldown>
      </table>
    </panel>
  </row>
  <row>
    <table>
      <title>showbla- $showbla$ showmaster - $showmaster$ shownonmaster - $shownonmaster$</title>
    </table>
  </row>
</dashboard>

neluvasilica
Explorer

that worked! thank you!

0 Karma

spavin
Path Finder

Hi @neluvasilica,

What you have so far is:

  • If you click on a row that starts with "(master)" then $master$ is set and $non_master$ is unset
  • If you click on a row that doesn't start with "(master)" then $master$ is unset and $non_master$ is set

The order of the conditions is important. If you want to match another option - eg "bla" then you'll need to check for that before you do the click.value != "(master)" check - because that will match everything that's not "(master)" and the processing will stop there.

Try this order:

<drilldown>
           <condition match="$click.value$ = &quot;bla&quot;">
             <set token="bla">$click.value$</set>
             <unset token="non_master"></unset>
             <unset token="master"></unset>
           </condition>
           <condition match="$click.value$ = &quot;(master)&quot;">
             <set token="master">$click.value$</set>
             <unset token="non_master"></unset>
             <unset token="blah"
           </condition>
           <condition match="$click.value$ != &quot;(master)&quot;">
             <set token="non_master">$click.value$</set>
             <unset token="master"></unset>
             <unset token="bla"></unset>
           </condition>
 </drilldown>

If you want a generic catch-all condition to set $non_master$, you can simply put <conditon>...</conditon> as the last block. It will only match if none of the other conditions matched.

I assumed you also wanted a token $bla$ created - if not, just set master / non_master to suit your needs when it matches bla.

Cheers,
Daniel

0 Karma

neluvasilica
Explorer

Hi @spavin,
Thanks for pointing the order out. That helps.
However it seems to me the matching condition applies to exact match only. So for instance if I have a graph with several values like: (master), abc-bla-01, abc-foo-01, abc-bla-02,abc-foo-02,abcd002, I'd like the following behavior.

  • clicking on (master) displays a new panel specific to (master)
  • clicking on any value containing "bla" displays a different panel specific to bla and hides the (master) panel
  • clicking on any other value apart from (master) and values containing "bla" hides the panels above and displays something new.

The condition match for "bla" works as long as I type in the full value but I was not able to create a condition match which would capture any click.value containing that string.
Thanks,
Nelu

0 Karma
Get Updates on the Splunk Community!

BSides Splunk 2022 - The Call for Papers is now Open!

TLDR; Main Site: https://bsidessplunk.com CFP Site: https://bsidessplunk.com/cfp CFP Opens: December 15th, ...

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...