Dashboards & Visualizations

progress and token explanation

lostcauz3
Path Finder

 

<panel depends="show_panel">
 <title>xyz</title>
 <search base="main_base">
 <progress>
  <condition>
   <set token="show_panel">true</set>
  <condition>
  <condition>
   <unset token="show_panel"></unset>
  <condition>
 </progress>
 <query> | search months="$tok_mon$" </query>
 </search>
</panel>

 

 

can anyone explain what the above xml code is doing with the token show_panel and what the progress Tag is doing or does?

this is a drilldown xml code .

Labels (4)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Probably not what you are expecting!

When the first condition is satisfied (since this is empty, it will always be satisfied), the token is set to true. The second condition is never evaluated

Apart from this, there are a number of other errors in the xml you posted - the depends need $ around the token name, the condition tags are not properly closed, for example.

If you wanted the panel to appear once the search is complete, you could do something like this

<panel depends="$show_panel$">
 <title>xyz</title>
 <search base="main_base">
 <done>
  <condition>
   <set token="show_panel">true</set>
  </condition>
 </done>
 <progress>
  <condition>
   <unset token="show_panel"></unset>
  </condition>
 </progress>
 <query> | search months="$tok_mon$" </query>
 </search>
</panel>

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Probably not what you are expecting!

When the first condition is satisfied (since this is empty, it will always be satisfied), the token is set to true. The second condition is never evaluated

Apart from this, there are a number of other errors in the xml you posted - the depends need $ around the token name, the condition tags are not properly closed, for example.

If you wanted the panel to appear once the search is complete, you could do something like this

<panel depends="$show_panel$">
 <title>xyz</title>
 <search base="main_base">
 <done>
  <condition>
   <set token="show_panel">true</set>
  </condition>
 </done>
 <progress>
  <condition>
   <unset token="show_panel"></unset>
  </condition>
 </progress>
 <query> | search months="$tok_mon$" </query>
 </search>
</panel>
0 Karma

lostcauz3
Path Finder

when does the token get unset  inside the progress tag? is it at the end of the search or when it is ongoing?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Ongoing - $job.resultcount$ is updated during the search, so you can use that in your conditions too, if that helps

0 Karma

lostcauz3
Path Finder

 

<row>
    <panel depends="$show_panel2$">
      <chart>
        <search base="main_base">
          <progress><condition>
            <set token="show_panel2">true</set>
          </condition>
          </progress>
          <query>|  search date="$tok_mon$"</query>
        </search>
      </chart>
    </panel>
  </row>


in the above case if i the token $tok_mon$ is not initialized and the search will be stuck at waiting for input but still it's not showing the panel.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

I am not sure what the purpose of this example is - if you want the panel to show even when it is waiting for input and when it is performing the search, just remove the depends?

0 Karma

lostcauz3
Path Finder

if the search is stuck in 'waiting for input' state then the progress tab will not run the condition and set the token you mean?


As stated by you earlier that it will always be true so show_panel2 should be true also for the above code?

Sorry I'm getting confused.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

The search apparently isn't in progress because it hasn't started due to the missing input.

What I meant earlier was that within the progress handler, the conditions are processed in order, and since the first one has no condition to evaluate, it will always evaluate to true so it will be the only one to be evaluated and the second condition is never reached. This is predicated on there being progress in the first place.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...