Dashboards & Visualizations

drilldown condition set token based on click.value

neluvasilica
Explorer

I currently have a drill down dashboard which sets tokens depending on the $click.value$.

<drilldown>
          <condition match="$click.value$ != &quot;(master)&quot;">
            <set token="non_master">$click.value$</set>
            <unset token="master"></unset>
          </condition>
          <condition match="$click.value$ = &quot;(master)&quot;">
            <set token="master">$click.value$</set>
            <unset token="non_master"></unset>
          </condition>
</drilldown>

I would want to add another condition which would set a token if $click.value$ contains a specific string, let's say "bla". I have tried using like and match but without success.
Any suggestion on how can I achieve this?

0 Karma
1 Solution

vnravikumar
Champion

Hi

Check this

<dashboard>
  <label>drilldown</label>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults 
| eval temp="(master), abc-bla-01, abc-foo-01, abc-bla-02,abc-foo-02,abcd002" 
| makemv delim="," temp 
| eval temp =trim(temp) 
| mvexpand temp</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="count">10</option>
        <option name="drilldown">cell</option>
        <drilldown>
          <condition match="like('row.temp',&quot;%bla%&quot;)">
            <set token="showbla">true</set>
            <unset token="showmaster"></unset>
            <unset token="shownonmaster"></unset>
          </condition>
          <condition match="'row.temp'== &quot;(master)&quot;">
            <set token="showmaster">true</set>
            <unset token="showbla"></unset>
            <unset token="shownonmaster"></unset>
          </condition>
          <condition match="'row.temp'!= &quot;master&quot;">
            <set token="shownonmaster">true</set>
            <unset token="showbla"></unset>
            <unset token="showmaster"></unset>
          </condition>
        </drilldown>
      </table>
    </panel>
  </row>
  <row>
    <table>
      <title>showbla- $showbla$ showmaster - $showmaster$ shownonmaster - $shownonmaster$</title>
    </table>
  </row>
</dashboard>

View solution in original post

vnravikumar
Champion

Hi

Check this

<dashboard>
  <label>drilldown</label>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults 
| eval temp="(master), abc-bla-01, abc-foo-01, abc-bla-02,abc-foo-02,abcd002" 
| makemv delim="," temp 
| eval temp =trim(temp) 
| mvexpand temp</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="count">10</option>
        <option name="drilldown">cell</option>
        <drilldown>
          <condition match="like('row.temp',&quot;%bla%&quot;)">
            <set token="showbla">true</set>
            <unset token="showmaster"></unset>
            <unset token="shownonmaster"></unset>
          </condition>
          <condition match="'row.temp'== &quot;(master)&quot;">
            <set token="showmaster">true</set>
            <unset token="showbla"></unset>
            <unset token="shownonmaster"></unset>
          </condition>
          <condition match="'row.temp'!= &quot;master&quot;">
            <set token="shownonmaster">true</set>
            <unset token="showbla"></unset>
            <unset token="showmaster"></unset>
          </condition>
        </drilldown>
      </table>
    </panel>
  </row>
  <row>
    <table>
      <title>showbla- $showbla$ showmaster - $showmaster$ shownonmaster - $shownonmaster$</title>
    </table>
  </row>
</dashboard>

neluvasilica
Explorer

that worked! thank you!

0 Karma

spavin
Path Finder

Hi @neluvasilica,

What you have so far is:

  • If you click on a row that starts with "(master)" then $master$ is set and $non_master$ is unset
  • If you click on a row that doesn't start with "(master)" then $master$ is unset and $non_master$ is set

The order of the conditions is important. If you want to match another option - eg "bla" then you'll need to check for that before you do the click.value != "(master)" check - because that will match everything that's not "(master)" and the processing will stop there.

Try this order:

<drilldown>
           <condition match="$click.value$ = &quot;bla&quot;">
             <set token="bla">$click.value$</set>
             <unset token="non_master"></unset>
             <unset token="master"></unset>
           </condition>
           <condition match="$click.value$ = &quot;(master)&quot;">
             <set token="master">$click.value$</set>
             <unset token="non_master"></unset>
             <unset token="blah"
           </condition>
           <condition match="$click.value$ != &quot;(master)&quot;">
             <set token="non_master">$click.value$</set>
             <unset token="master"></unset>
             <unset token="bla"></unset>
           </condition>
 </drilldown>

If you want a generic catch-all condition to set $non_master$, you can simply put <conditon>...</conditon> as the last block. It will only match if none of the other conditions matched.

I assumed you also wanted a token $bla$ created - if not, just set master / non_master to suit your needs when it matches bla.

Cheers,
Daniel

0 Karma

neluvasilica
Explorer

Hi @spavin,
Thanks for pointing the order out. That helps.
However it seems to me the matching condition applies to exact match only. So for instance if I have a graph with several values like: (master), abc-bla-01, abc-foo-01, abc-bla-02,abc-foo-02,abcd002, I'd like the following behavior.

  • clicking on (master) displays a new panel specific to (master)
  • clicking on any value containing "bla" displays a different panel specific to bla and hides the (master) panel
  • clicking on any other value apart from (master) and values containing "bla" hides the panels above and displays something new.

The condition match for "bla" works as long as I type in the full value but I was not able to create a condition match which would capture any click.value containing that string.
Thanks,
Nelu

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...