Solved: Splunk Dashboard - Change On Condition

beriwalnishant

Hello Experts,

I am trying to work on setting up panels with two different queries output based on a filter. I am using the change on condition option

<input type="dropdown" token="spliterror_1" searchWhenChanged="true">
<label>Splits</label>
<choice value="*">All</choice>
<choice value="false">Exclude</choice>
<choice value="true">Splits Only</choice>
<prefix>isSplit="</prefix>
<suffix>"</suffix>
<default>$spliterror_1$</default>
<change>
<condition label="All">
<set token="ShowAll">*</set>
<unset token="ShowTrue"></unset>
<unset token="ShowFalse"></unset>
</condition>
<condition label="Exclude">
<unset token="ShowAll"></unset>
<set token="ShowFalse">false</set>
<unset token="ShowTrue"></unset>
</condition>
<condition label="Splits Only">
<unset token="ShowAll"></unset>
<unset token="ShowFalse"></unset>
<set token="ShowTrue">true</set>
</condition>
</change>
</input>

The setting/unsetting token displays the panel accordingly but in backend all 3 queries run simultaneously, is there a way that only one condition and related query run only on selection basis

Nishant

ITWhisperer

Try something like this - note the use of empty tokens rather than "true" and "false" (I have added done handlers to show when the searches complete - which they don't if they are still waiting for input from the unset tokens).

<form version="1.1" theme="light">
  <label>Change on Condition</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="spliterror_1" searchWhenChanged="true">
      <label>Splits</label>
      <choice value="*">All</choice>
      <choice value="false">Exclude</choice>
      <choice value="true">Splits Only</choice>
      <prefix>isSplit="</prefix>
      <suffix>"</suffix>
      <default>*</default>
      <change>
        <condition label="All">
          <set token="ShowTrue"></set>
          <set token="ShowFalse"></set>
        </condition>
        <condition label="Exclude">
          <set token="ShowFalse"></set>
          <unset token="ShowTrue"></unset>
        </condition>
        <condition label="Splits Only">
          <unset token="ShowFalse"></unset>
          <set token="ShowTrue"></set>
        </condition>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <html>
        <p>Exclude completed $ExcludeComplete$</p>
        <p>Split only completed $SplitOnlyComplete$</p>
      </html>
    </panel>
  </row>
  <row>
    <panel depends="$ShowFalse$">
      <table>
        <title>Exclude</title>
        <search>
          <done>
            <eval token="ExcludeComplete">strftime(time(),"%F %T")</eval>
          </done>
          <query>index=_internal
$ShowFalse$
| stats count by component</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
    <panel depends="$ShowTrue$">
      <table>
        <title>Split only</title>
        <search>
          <done>
            <eval token="SplitOnlyComplete">strftime(time(),"%F %T")</eval>
          </done>
          <query>index=_internal
$ShowTrue$
| stats count by component</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</form>

View solution in original post

beriwalnishant

I tried one, it did work but I can see in backend it still executed the query with 7MB query load

ITWhisperer

Please share what you have tried.

beriwalnishant

I added a fake field with a fake value in the query, was added by selecting a drop down option as additional step

ITWhisperer

Try something like this - note the use of empty tokens rather than "true" and "false" (I have added done handlers to show when the searches complete - which they don't if they are still waiting for input from the unset tokens).

<form version="1.1" theme="light">
  <label>Change on Condition</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="spliterror_1" searchWhenChanged="true">
      <label>Splits</label>
      <choice value="*">All</choice>
      <choice value="false">Exclude</choice>
      <choice value="true">Splits Only</choice>
      <prefix>isSplit="</prefix>
      <suffix>"</suffix>
      <default>*</default>
      <change>
        <condition label="All">
          <set token="ShowTrue"></set>
          <set token="ShowFalse"></set>
        </condition>
        <condition label="Exclude">
          <set token="ShowFalse"></set>
          <unset token="ShowTrue"></unset>
        </condition>
        <condition label="Splits Only">
          <unset token="ShowFalse"></unset>
          <set token="ShowTrue"></set>
        </condition>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <html>
        <p>Exclude completed $ExcludeComplete$</p>
        <p>Split only completed $SplitOnlyComplete$</p>
      </html>
    </panel>
  </row>
  <row>
    <panel depends="$ShowFalse$">
      <table>
        <title>Exclude</title>
        <search>
          <done>
            <eval token="ExcludeComplete">strftime(time(),"%F %T")</eval>
          </done>
          <query>index=_internal
$ShowFalse$
| stats count by component</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
    <panel depends="$ShowTrue$">
      <table>
        <title>Split only</title>
        <search>
          <done>
            <eval token="SplitOnlyComplete">strftime(time(),"%F %T")</eval>
          </done>
          <query>index=_internal
$ShowTrue$
| stats count by component</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</form>

beriwalnishant

Ultimate, this worked super fine, but may I ask you to explain to me the logic as to how it is working? why did we strip time in both of the new tokens we created?

ITWhisperer

The logic is that searches only execute when all tokens in that particular search have been defined. Tokens effectively have three states (it is really only two, but for the purposes of this explanation we'll go with three). The token is either set to a value (non-empty), or is empty (these first two are really one state), or the token is unset (or set to null(), which equates to the same thing).

The depends attribute on the panel (or row), identifies which tokens need to be set (non-null). For completeness, the rejects attribute identifies which tokens need to be unset (or null).

By setting the relevant token to nothing, the token can satisfy the depends attribute, and when used in the search does not add any additional SPL.

By unsetting the relevant token (or setting it to null()), the depends attribute is not satisfied (so the panel/row is hidden), and the search stops executing (because it is waiting for the token to be set).

The strftime() is used in the done handler to set tokens so that you can visually see when the search is complete, i.e. to give you the confidence that the search is or is not running. You don't need them if you are happy with your searches only executing when they are supposed to.

beriwalnishant

Hi There

Can you tell me why this is not working, I see both searches in both table depends token are executing I used your logic itself

      <input type="dropdown" token="indextypeboss" searchWhenChanged="true">
        <label>Select Index</label>
        <choice value="bexg-reservations-air">Live Index</choice>
        <choice value="summary-bex-aircpr-details">Summary Index</choice>
        <prefix>index="</prefix>
        <suffix>"</suffix>
        <change>
          <condition label="Live Index">
            <set token="ShowLiveIndexboss"></set>
            <unset token="ShowSummaryIndexboss"></unset>
          </condition>
          <condition label="Summary Index">
            <unset token="ShowLiveIndexboss"></unset>
            <set token="ShowSummaryIndexboss"></set>
          </condition>
        </change>
        <default>summary-bex-aircpr-details</default>
      </input>
      
      
      
      <input type="time" token="ctimeairboss" searchWhenChanged="true">
        <label>Select Time Range</label>
        <default>
          <earliest>-60m@m</earliest>
          <latest>now</latest>
        </default>
      </input>
      <table depends="$ShowLiveIndexboss$">
        <title>Success/Fail Ratio on selected TPID, Carrier &amp; GDS (Sorted by Failed Count)</title>
        <search>
          <query>$indextypeboss$ my query</query>
          <earliest>$ctimeairboss.earliest$</earliest>
          <latest>$ctimeairboss.latest$</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
      
      
      <table depends="$ShowSummaryIndexboss$">
        <title>Success/Fail Ratio on selected TPID, Carrier &amp; GDS (Sorted by Failed Count)</title>
        <search>
          <query>$indextypeboss$ my query</query>
          <earliest>$ctimeairboss.earliest$</earliest>
          <latest>$ctimeairboss.latest$</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>

ITWhisperer

You haven't followed the logic, you are using the wrong tokens in your searches. Try something like this

      <input type="dropdown" token="indextypeboss" searchWhenChanged="true">
        <label>Select Index</label>
        <choice value="bexg-reservations-air">Live Index</choice>
        <choice value="summary-bex-aircpr-details">Summary Index</choice>
        <prefix>index="</prefix>
        <suffix>"</suffix>
        <change>
          <condition label="Live Index">
            <set token="ShowLiveIndexboss"></set>
            <unset token="ShowSummaryIndexboss"></unset>
          </condition>
          <condition label="Summary Index">
            <unset token="ShowLiveIndexboss"></unset>
            <set token="ShowSummaryIndexboss"></set>
          </condition>
        </change>
        <default>summary-bex-aircpr-details</default>
      </input>
      
      
      
      <input type="time" token="ctimeairboss" searchWhenChanged="true">
        <label>Select Time Range</label>
        <default>
          <earliest>-60m@m</earliest>
          <latest>now</latest>
        </default>
      </input>
      <table depends="$ShowLiveIndexboss$">
        <title>Success/Fail Ratio on selected TPID, Carrier &amp; GDS (Sorted by Failed Count)</title>
        <search>
          <query>$ShowLiveIndexboss$ my query</query>
          <earliest>$ctimeairboss.earliest$</earliest>
          <latest>$ctimeairboss.latest$</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
      
      
      <table depends="$ShowSummaryIndexboss$">
        <title>Success/Fail Ratio on selected TPID, Carrier &amp; GDS (Sorted by Failed Count)</title>
        <search>
          <query>$ShowSummaryIndexboss$ my query</query>
          <earliest>$ctimeairboss.earliest$</earliest>
          <latest>$ctimeairboss.latest$</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>

beriwalnishant

aha, glad I asked; I now understand it.

the $ShowLiveIndex$ and $ShowSummaryIndex$ in search query puts in "" ... .the double quote signs, which technically means nothing.....and hence it works

thanks a lot

This will help me a lot to make one Dashboard Dual, Live Query and Summary Index switchable rather than 2 versions as we were keeping

Super thanks again

beriwalnishant

Thanks a lot. I removed <done> strftime... It's working fine. Only one panel works at a time, the other one says 'waiting for an input'

To understand this better and why the same is not working in this code, I failed to determine the difference. This code below is running all 3 queries in the panels parallel

      <input type="dropdown" token="spliterror_1" searchWhenChanged="true">
        <label>Splits</label>
        <choice value="*">All</choice>
        <choice value="false">Exclude</choice>
        <choice value="true">Splits Only</choice>
        <prefix>isSplit="</prefix>
        <suffix>"</suffix>
        <default>$spliterror_1$</default>
        <change>
          <condition label="All">
            <set token="ShowAll">*</set>
            <unset token="ShowTrue"></unset>
            <unset token="ShowFalse"></unset>
          </condition>
          <condition label="Exclude">
            <unset token="ShowAll"></unset>
            <set token="ShowFalse">false</set>
            <unset token="ShowTrue"></unset>
          </condition>
          <condition label="Splits Only">
            <unset token="ShowAll"></unset>
            <unset token="ShowFalse"></unset>
            <set token="ShowTrue">true</set>
          </condition>
        </change>
      </input>

      <table depends="$ShowAll$">
        <title>% Ratio on selected  (Sorted by Failed)</title>
        <search>
          <query>my query
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
      <table depends="$ShowTrue$">
        <title> % Ratio on selected  (Sorted by Failed)</title>
        <search>
          <query>my search</query>
          <earliest>$timeerror_1.earliest$</earliest>
          <latest>$timeerror_1.latest$</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
      <table depends="$ShowFalse$">
        <title> % Ratio on selected (Sorted by Failed)</title>
        <search>
          <query>my search</query>
          <earliest>$timeerror_1.earliest$</earliest>
          <latest>$timeerror_1.latest$</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>

beriwalnishant

Actually sorry, ignore me. I understood why. I understood it all so all good thanks a lot again

beriwalnishant

Can you share an example

ITWhisperer

Yes, set up tokens in the searches which make the search invalid when they are not needed e.g. they contain illegal SPL syntax

Splunk Dashboard - Change On Condition

other

Fueling your curiosity with new Splunk ILT and eLearning courses

Splunk AI Assistant for SPL 1.1.0 | Now Personalized to Your Environment for Greater ...

Unleash Unified Security and Observability with Splunk Cloud Platform