dynamic dashboard

[rashid47010]

Hi
I have one idea in my mind that if we have three panels in one dashboard

1-Actions(failed,passed)
2-Top 10 source IP
3-Top 10 destination IP

I want remaining two panales(2 and 3) depanded on 1st panel. like If I select action=passed then the source and destination values shoud be updated accordingly.

[woodcock · Accepted solution]

You can use the depends directive to make panels dependant on tokens that are set via other panels/controls/means:

http://docs.splunk.com/Documentation/Splunk/latest/Viz/tokens
https://answers.splunk.com/answers/188709/how-to-display-dashboard-panels-dynamically.html
https://answers.splunk.com/answers/479032/what-is-the-xml-syntax-to-hide-panels-with-two-dep.html

[rashid47010]

hi wood,

At last I have achieved successfully what I was looking for. I have one parent panel and two other panels who are taking input from parent panel. for example, top source and destination IP's are taking input of field action=allowed OR blocked. based on that panel-1 and panel-2 values updates.

Now I want to update the Panel-2 (destination IP's) based on Panel-1 (source IP) selection.

How can we do that.

[woodcock]

I assume that you are talking about some kind of drilldown but I am not sure. You should ask a new question and include much more detail. But before you do, download the "Splunk 6.x Dashboard Examples":
https://splunkbase.splunk.com/app/1603/
It is chock full of great drilldown trickiness.

[rashid47010]

i achieve this by adding another drilldown in second panel as shown below:

      <set token="show_panel">true</set>
      <set token="selected_value1">$click.value$</set>
    </drilldown>

but here the historical(previous) values are not shown as I was seeing previously.