Dashboards & Visualizations

hide panel after search is executed

Mike6960
Path Finder

Hi, I've managed to add a 'Input' (T Text) in y dashboard. I also added a 'submit' button. When I search for something a panel dynamically appears on my dashboard with (or without) search results. I have two questions
1-I added the submit button so that the user 'sees' something happening when they enter a search word, without this button it seems not to do anything
2- Initially the dynamic panel (with the use of 'depends') is not visible (as expected), but after the first search has been exceuted the panel stays visible. Is there a way I can hide the panel when no other search has to been done?

Tags (1)
0 Karma
1 Solution

niketn
Legend

How does Splunk know that 'field2' is the same as 'tokField2' ?
They are not

If field2 is NULL i.e. $field2$ if you try to display the same, then tokField2 is NULL
Even if field2 is EMPTY i.e. field2= then also tokField2 is NULL.

Which implies if you use field2 as depends for your panel to be hidden when no data in Text Box try the following 2 steps:
1) Refresh or freshly load the dashboard and key in some text like test and Tab out, you should see the HTML Panel
2) Empty the text box by clearing test and then tab out. Expected behavior is for the HTML Panel to be hidden since Text is not present but the same should be visible because field2 is EMPTY not NULL.

Yes for text box input to be registered you always need to tab out or interact with element other than text box (like click on Submit button implies you have focused out of Text box in order to click the Submit button.). If you want Text input to be registered on each letter being typed in the text box, you would need to create your own JavaScript. This also means that your Search query will also ru every type a letter is typed in the text box. For example Search will run 4 times when you type test in the text box, also 4 times when you try to delete 1 letter at a time. Do you really want this overhead just not to tab out of the text box?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn
Legend

Yes that is the idea of using this without Submit Button. Tabbing out triggers the input change event.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

niketn
Legend

@Mike6960, would it be possible for you to add text box input and panel code?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

Mike6960
Path Finder

@niketnilay

WlzServicesLog

<input type="time" token="field1">
  <label></label>
  <default>
    <earliest>-24h@h</earliest>
    <latest>now</latest>
  </default>
</input>
<input type="text" token="field2" searchWhenChanged="true">
  <label>Zoeken</label>
  <prefix>field3</prefix>
</input>


<panel>
  <title>test</title>
  <event>
    <search>
      <query>index= xp* </query>
      <earliest>$field1.earliest$</earliest>
      <latest>$field1.latest$</latest>
      <sampleRatio>1</sampleRatio>
    </search>
    <option name="count">20</option>
    <option name="list.drilldown">none</option>
    <option name="list.wrap">1</option>
    <option name="maxLines">5</option>
    <option name="raw.drilldown">full</option>
    <option name="refresh.display">progressbar</option>
    <option name="rowNumbers">0</option>
    <option name="table.drilldown">all</option>
    <option name="table.sortDirection">asc</option>
    <option name="table.wrap">1</option>
    <option name="type">list</option>
  </event>
</panel>


<panel depends="$field2$">&gt;<title>test variabel</title>
  <table>
    <search>
      <query>index=XPO $field2$ |sort -Timestamp|table tijd severity message priority machine</query>
      <earliest>-24h@h</earliest>
      <latest>now</latest>
    </search>
    <option name="drilldown">cell</option>
    <drilldown>
      <link target="_blank">search?q=index=XPO $field2$* |sort -Timestamp|table tijd severity message priority machine&amp;earliest=-24h@h&amp;latest=now</link>
    </drilldown>
  </table>
</panel>
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...