Dashboards & Visualizations

how to make an input form independant of other inputs.

schou87
Path Finder

I have 3 panels and three inputs ( two multiselect and one search input box). The first two panels in first row are column charts and the third panel element in second row is a table . I want to use the two multiselect dropdowns to populate data in all the 3 panels. But the select text input should only affect results of third  panel after data is populated by the dropdowns.

Is there a way I can use search input after information is populated as a result of the dropdowns and get the required information. 

Right now, I am getting "No result found "in the third panel which is actioned by both dropdowns and  the search input box . 

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @schou87,

As I said, use a default value (*) for the third input and see the results.

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @schou87,

I don't see any automated way to do what you ask, as a workaround you could populate the two dropdowns using a default value for the third input and eventually after panel's completion insert a value in the text search and execute a new search.

Actually I can't completely understand what you mean by "use search input after information is populated as a result of the dropdowns and get the required information": you want to have the results before using the third input, after use, or both ?

About the "No results found", to be helped you should share the search of the this panel and the inputs.

Last question: do you have "No results found" after the use of the thirtd input or also before (with a default value)?

Ciao.

Giuseppe

0 Karma

schou87
Path Finder

you want to have the results before using the third input, after use, or both ? - after selecting input from dropdowns, once data is populated I want to be able to use search to filter results

 

do you have "No results found" after the use of the thirtd input or also before (with a default value)? - there is no default value in search as of now . Below is xml for the panel in question

 

<row depends="$showChart1$">
<panel>
<title>Details of the Pending Files - - As per selection</title>
<input type="text" token="ID" searchWhenChanged="true">
<label>ID</label>
</input>
<table>
<title>Detailed report </title>
<search>
<query>base query Date IN($Date$) Template($Template$) ID IN ($ID$) earliest=-2h@m |  dedup SYSID | eval TIME_SPENT=round(((now()-strptime(T1,"%Y-%m-%d %H:%M:%S"))/3600),2)| table field1,field2, field3, TIME_SPENT </query>
</search>
<option name="count">10</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">true</option>
<option name="totalsRow">false</option>
<option name="wrap">false</option>
</table>
</panel>
</row>

 

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Build your search for the third panel so that the values from the dropdowns are used before the value from the text input

0 Karma

schou87
Path Finder

Below is the xml for panel in Question. I have used panel specific forms already.

<row depends="$showChart1$">
<panel>
<title>Details of the Pending Files - - As per selection</title>
<input type="text" token="ID" searchWhenChanged="true">
<label>ID</label>
</input>
<table>
<title>Detailed report </title>
<search>
<query>base query Date IN($Date$) Template($Template$) ID IN ($ID$) earliest=-2h@m |  dedup SYSID | eval TIME_SPENT=round(((now()-strptime(T1,"%Y-%m-%d %H:%M:%S"))/3600),2)| table field1,field2, field3, TIME_SPENT </query>
</search>
<option name="count">10</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">true</option>
<option name="totalsRow">false</option>
<option name="wrap">false</option>
</table>
</panel>
</row>

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @schou87,

did you use commas between the words you inserted in the text input?

The IN operator requires that you divide terms to search using commas.

A little hint: when you have to share code in a Community message (as in your last message), please use the Insert/Edit code sample button (</>) to better display it.

Ciao.

Giuseppe

0 Karma

schou87
Path Finder

Hi, I have only one token to be passed for a particular field. Hence there are no commas required.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @schou87,

if you put only one word in the text input have you results?

Ciao.

Giuseppe

0 Karma

schou87
Path Finder

When I put a value in search text input, nothing comes up.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Have you tried opening the search in a search tab and see whether the search query makes sense?

0 Karma

schou87
Path Finder

The search query makes sense . I am just little skeptical if the tokens are passed in the right way or not in the query for my purpose.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You could try using a token modifier which will put the token value in quotes for example

IN ($ID|s$)
0 Karma

schou87
Path Finder

I am using the tokens in similar way for the other chart elements that use the dropdown. And they seem to work perfectly.

The panel say "No results found" when i refresh the page is because there is no id input to begin with as it filters data based on default which ID = null although the other two token conditions are met.

How do I have the infomation populated already using the dropdown tokens and then use the text input to filter data.?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @schou87,

As I said, use a default value (*) for the third input and see the results.

Ciao.

Giuseppe

schou87
Path Finder

Worked perfect. Guess I was thinking too far ahead and missed a simple thing.

Thanks @gcusello 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Or have the change handler for the text input set a different token with the complete phrase of the search 

<set token="in_token">ID IN ($ID$)</set>

and use this token in the search

Template($Template$) $in_token$ earliest=-2h@m
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...