Dashboards & Visualizations

xml: Multiple change blocks in input

weidertc
Communicator

I have a dropdown input with multiple <change> tags. I need to do two things: 1) set a token based on the value of the dropdown, and 2) set the value of another dropdown based on the value of the current one. If i put the change block that sets the token first, then the 2nd dropdown value doesn't update. If i put the change block that sets the value of the 2nd dropdown, my token isn't set. I can only get one or the other based on the order of the change blocks.

<change>
    <condition match="'value' == &quot;4.1.1&quot; OR 'value' == &quot;4.1.2&quot;">
      <set token="showPanel">true</set>
    </condition>
    <condition>
      <unset token="showPanel"></unset>
    </condition>
  </change>
  <change>
    <condition match="$value$ == &quot;None&quot;">
      <set token="form.input2">None</set>
    </condition>
    <condition match="$value$ != &quot;None&quot;">
      <set token="form.input2">%</set>
    </condition>
  </change>

I tried just merging them into a single change block but I get the same result. It seems to quit out at the first match from both the condition and all additional changes i need to make happen.

how can i get both?

Chris

0 Karma
1 Solution

niketn
Legend

@weidertc when you merged the conditions did you try the following?

   <change>
     <condition match="$value$ == &quot;4.1.1&quot; OR $value$ == &quot;4.1.2&quot;">
       <set token="showPanel">true</set>
       <set token="form.input2">%</set>
     </condition>
     <condition match="$value$ == &quot;None&quot;">
       <set token="form.input2">None</set>
       <unset token="showPanel"></unset>
     </condition>
     <condition match="$value$ != &quot;None&quot;">
       <set token="form.input2">%</set>
       <unset token="showPanel"></unset>
     </condition>
     <condition>
       <unset token="showPanel"></unset>
     </condition>
   </change>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

niketn
Legend

@weidertc when you merged the conditions did you try the following?

   <change>
     <condition match="$value$ == &quot;4.1.1&quot; OR $value$ == &quot;4.1.2&quot;">
       <set token="showPanel">true</set>
       <set token="form.input2">%</set>
     </condition>
     <condition match="$value$ == &quot;None&quot;">
       <set token="form.input2">None</set>
       <unset token="showPanel"></unset>
     </condition>
     <condition match="$value$ != &quot;None&quot;">
       <set token="form.input2">%</set>
       <unset token="showPanel"></unset>
     </condition>
     <condition>
       <unset token="showPanel"></unset>
     </condition>
   </change>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

weidertc
Communicator

thanks, this works. I don't think I can escape having an ever increasing list of conditions when new panels get added, but this looks doable. I get to keep them all on a single input dropdown.

I added a condition so "All" will work, based on the value of another dropdown (the one higher up in the hierarchy)

  <change>
    <condition match="('value' == &quot;%&quot; AND $field3$ == &quot;4.1&quot;) OR 'value' == &quot;4.1.1&quot; OR 'value' == &quot;4.1.2&quot;">
      <set token="form.field4">%</set>
      <set token="showPanel">true</set>
    </condition>
    <condition match="$value$ == &quot;None&quot;">
      <set token="form.field4">None</set>
      <unset token="showPanel"></unset>
    </condition>
    <condition match="$value$ != &quot;None&quot;">
      <set token="form.field4">%</set>
      <unset token="showPanel"></unset>
    </condition>
    <condition>
      <unset token="showPanel"></unset>
    </condition>
  </change>

niketn
Legend

@weidertc you can explore the following two alternatives:

1) Use SplunkJS with JavaScript Change Handler on Token Model to apply your custom logic in JavaScript to have more code like control.
PS: This will be complicated to implement require you to be aware of JavaScript, Simple XML JS Extension and Splunk JS Stack. Refer to documentation: http://dev.splunk.com/view/SP-CAAAEW4

2) Use an independent search with | makeresults | eval dropdownValue=$yourDropDownTokenValue$ .... to use SPL to get the values of all the Input selections and use eval with case() function to set the token values accordingly. Finally use search event handler to set/unset required tokens based on values set in SPL.
PS: This will require conversion of your tokens and requirement into SPL (should not be big of a deal). But will add one additional search to your dashboard (should run fast though as it is not pulling transactional data from index or any other data source).

In case you do run into an issue where too many conditions are too complicated to be formed inside input's change event handler, you can definitely think about Splunk Answers community again 🙂

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

weidertc
Communicator

Thanks, i'll take a look at SplunkJS. If it has to be installed, and if we don't have it, we probably won't get it.

For 2), i'm not sure what SPL is. Can you clarify? Also, where would I use the independent search?

0 Karma

vnravikumar
Champion

Hi @weidertc

Please check whether it helps you

<form>
  <label>dropdown</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="field1">
      <label>First Dropdown</label>
      <choice value="red">Red</choice>
      <choice value="blue">Blue</choice>
      <choice value="black">Black</choice>
      <change>
        <condition label="Red">
          <set token="form.field2">green</set>
          <set token="showPanel"> true</set>
        </condition>
        <condition label="Blue">
          <set token="form.field2">white</set>
          <unset token="showPanel"> </unset>
        </condition>
      </change>
    </input>
    <input type="dropdown" token="field2">
      <label>Second Dropdown</label>
      <choice value="green">Green</choice>
      <choice value="white">White</choice>
    </input>
  </fieldset>
</form>
0 Karma

weidertc
Communicator

thanks for the reply. unfortunately, since the conditions are unrelated, i cannot set the input2 value at the time i decide whether to show the panel. I should have clarified this earlier, sorry.

0 Karma

vnravikumar
Champion

Can you please explain your requirement.

0 Karma

weidertc
Communicator

I'll have to get specific.

The 2 conditions do unrelated things. it's a dropdown that's populated based on the values of yet another dropdown. there's 4 dropowns in linear hierarchy if it helps. this is the 3rd one down.

If "None" is chosen, then i want the 4th dropdown to show "None". If anything else is chosen, then I want the 4th dropdown to show "All" until the user selects a different one. this is independent of the panel i want to show.

If 2 values are specifically chosen, then i want a particular panel to show. it's specific to a value chosen in the 1st, 2nd, and 3rd dropdowns, but there's enough info in the 3rd dropdown only at the moment to know. this will stay off most of the time since that panel's values can change a lot and those 2 values may not even be in the resultset based on what the user chose in the 1st and 2nd dropdown.

There are going to be a lot of specific panels based on dropdown values, so a solution should scale nicely.

hope this clears it up.

0 Karma

vnravikumar
Champion

Hi @weidertc

Please check now,

  <form>
      <init>
            <unset token="showpanel"></unset>
      </init>
      <label>dropdown</label>
      <fieldset submitButton="false">
        <input type="dropdown" token="field1">
          <label>Third Dropdown</label>
          <choice value="none">None</choice>
          <choice value="red">Red</choice>
          <choice value="blue">Blue</choice>
          <choice value="black">Black</choice>
          <change>
            <condition match="$field1$ == &quot;none&quot;">
              <set token="form.field2">none</set>
              <unset token="showpanel"></unset>
            </condition>
            <condition match="$field1$ != &quot;none&quot;">
              <set token="form.field2">*</set>
            </condition>
          </change>
        </input>
        <input type="dropdown" token="field2">
          <label>Fourth Dropdown</label>
          <choice value="*">All</choice>
          <choice value="none">None</choice>
          <choice value="green">Green</choice>
          <choice value="white">White</choice>
          <change>
            <condition match="$field1$ == &quot;none&quot; or $field2$ == &quot;none&quot; or $field2$ == &quot;*&quot;">
              <unset token="showpanel"></unset>
            </condition>
            <condition>
              <set token="showpanel">true</set>
            </condition>
          </change>
        </input>
      </fieldset>
      <row>
        <panel depends="$showpanel$">
          <table>
            <search>
              <query>index="_internal"</query>
              <earliest>-24h@h</earliest>
              <latest>now</latest>
            </search>
            <option name="drilldown">none</option>
          </table>
        </panel>
      </row>
    </form>
0 Karma

weidertc
Communicator

It looks like you removed the part where only 1 of 2 values are supposed to show the panel, that being 4.1.1 and 4.1.2 in field1. all other values should hide the panel. would this be as simple as adding a match to the last condition of field2?

0 Karma

vnravikumar
Champion

yes you are correct,

0 Karma

weidertc
Communicator

this solution won't scale then, since it will match and break out of the change tag. I need a solution that will allow for multiple panels each with their own condition that may overlap.

sorry to be difficult, but am I otherwise correct in asserting that Splunk does not allow multiple condition sets on an input panel?

0 Karma

vnravikumar
Champion

Here panel will be shown one and only if a specific value is chosen in both dropdown. Otherwise, it will hide.

0 Karma

vnravikumar
Champion

I hope the above sample helps you.

0 Karma

vnravikumar
Champion

@weidertc Please let me know if you need any help further.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...