Splunk Enterprise

How to achieve multiselect input to hide/show multiple panels?

mnj1809
Path Finder

Hello,

Panels are not showing/hiding based on the selection of the multiselect input.

<form>
<label>Multiselect input to hide/show multiple panels</label>
<search>
<query>
| makeresults
| fields - _time
| eval data="$service_tok$"
| eval condition=case(match(data,"\*"),"show_all",match(data,"Windows") AND match(data,"NIX") AND match(data,"VMWare"),"show_all",match(data,"Windows"),"Windows",match(data,"NIX"),"NIX",match(data,"VMWare"),"VMWare")
| eval show_all=case(condition="show_all","true")
| eval show_windows=case(condition="Windows" OR condition="show_all","true")
| eval show_nix=case(condition="NIX" OR condition="show_all","true")
| eval show_vmware=case(condition="VMWare" OR condition="show_all","true")
</query>
<done>
<condition match="$job.resultCount$!=0">
<eval token="tokShowAll">case(isnotnull($result.show_all$),$result.show_all$)</eval>
<eval token="tokShowWindows">case(isnotnull($result.show_windows$),$result.show_windows$)</eval>
<eval token="tokShowNIX">case(isnotnull($result.show_nix$),$result.show_nix$)</eval>
<eval token="tokShowVMWare">case(isnotnull($result.show_vmware$),$result.show_vmware$)</eval>
</condition>
<condition>
<unset token="tokShowAll"></unset>
<unset token="tokShowWindows"></unset>
<unset token="tokShowNIX"></unset>
<unset token="tokShowVMWare"></unset>
</condition>
</done>
</search>
<fieldset submitButton="false">
<input type="time" token="field1">
<label></label>
<default>
<earliest>-60m@m</earliest>
<latest>now</latest>
</default>
</input>
<input type="multiselect" token="service_tok" searchWhenChanged="true">
<label>Select a Service</label>
<choice value="*">All</choice>
<choice value="Windows">Windows</choice>
<choice value="NIX">NIX</choice>
<choice value="VMWare">VMWare</choice>
<change>
<unset token="tokShowAll"></unset>
<unset token="tokShowWindows"></unset>
<unset token="tokShowNIX"></unset>
<unset token="tokShowVMWare"></unset>
</change>
<default>*</default>
<initialValue>*</initialValue>
<delimiter> </delimiter>
</input>
</fieldset>
<row>
<panel>
<title></title>
</panel>
</row>
<row depends="$tokShowWindows$">
<panel>
<table>
<title>Windows Request Count</title>
<search>
<query>host=abcd source="/access.log*" | timechart span=1hr count by host</query>
<earliest>-4h@m</earliest>
<latest>now</latest>
</search>
</table>
</panel>
</row>
<row depends="$tokShowNIX$">
<panel>
<table>
<title>NIX Request Count</title>
<search>
<query>host=abcd source="access.log" | timechart span=1hr count by host</query>
<earliest>-4h@m</earliest>
<latest>now</latest>
</search>
</table>
</panel>
</row>
<row depends="$tokShowVMWare$">
<panel>
<table>
<title>VMWare Request Count</title>
<search>
<query>host=abcd source="access.log" | timechart span=1hr count by host</query>
<earliest>-4h@m</earliest>
<latest>now</latest>
</search>
</table>
</panel>
</row>
</form>

@ITWhisperer 

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
<form version="1.1">
  <label>Multiselect Choice</label>
  <fieldset submitButton="false" autoRun="true">
    <input type="multiselect" token="alloptions" searchWhenChanged="true">
      <label></label>
      <choice value="*">All</choice>
      <choice value="second_choice">second choice</choice>
      <choice value="third_choice">third choice</choice>
      <choice value="fourth_choice">fourth choice</choice>
      <choice value="fifth_choice">fifth choice</choice>
      <delimiter>,</delimiter>
      <change>
        <eval token="form.alloptions">case(mvcount('form.alloptions')=0,"*",mvcount('form.alloptions')&gt;1 AND mvfind('form.alloptions',"\\*")&gt;0,"*",mvcount('form.alloptions')&gt;1 AND mvfind('form.alloptions',"\\*")=0,mvfilter('form.alloptions'!="*"),1==1,'form.alloptions')</eval>
        <eval token="second">if(isnotnull(mvfind('form.alloptions',"second_choice")) OR isnotnull(mvfind('form.alloptions',"\\*")),1,null())</eval>
        <eval token="third">if(isnotnull(mvfind('form.alloptions',"third_choice")) OR isnotnull(mvfind('form.alloptions',"\\*")),1,null())</eval>
        <eval token="fourth">if(isnotnull(mvfind('form.alloptions',"fourth_choice")) OR isnotnull(mvfind('form.alloptions',"\\*")),1,null())</eval>
        <eval token="fifth">if(isnotnull(mvfind('form.alloptions',"fifth_choice")) OR isnotnull(mvfind('form.alloptions',"\\*")),1,null())</eval>
      </change>
    </input>
  </fieldset>
  <row>
    <panel depends="$second$">
      <html>
        <p>Second Panel</p>
      </html>
    </panel>
    <panel depends="$third$">
      <html>
        <p>Third Panel</p>
      </html>
    </panel>
    <panel depends="$fourth$">
      <html>
        <p>Fourth Panel</p>
      </html>
    </panel>
    <panel depends="$fifth$">
      <html>
        <p>Fifth Panel</p>
      </html>
    </panel>
  </row>
</form>

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Please explain what each part of the dashboard is trying to do and how it is trying to do it?

0 Karma

mnj1809
Path Finder

Thanks for your prompt response.
I just want to show and hide panels based on the selection of values in Multiselect Input. For example, If I select "Windows" in the multiselect input then only panel "Windows Request Count" should be shown and if I select "Windows" and "NIX" in the multiselect input then panels "Windows Request Count" and NIX Request Count" should be shown.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Add a change handler to the multiselect to set the appropriate tokens based on the selection.

0 Karma

mnj1809
Path Finder

As you can see in my shared dashboard xml, I've added the change handler but it's not working as expected. could you please share another solution to achieve the requirement or update my shared xml please. Please see the attached screenshot for your reference.
I've selected "Windows" and "NIX" in the multiselect input but only "Windows Request Count" panel is shown however "NIX Request Count" panel should also be shown.

@ITWhisperer 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Your change handler on the multiselect is unsetting all the tokens, it is not setting any of them based on the input selected. This is where you need to have a change handler.

<form version="1.1">
  <label>Multiselect Choice</label>
  <fieldset submitButton="false" autoRun="true">
    <input type="multiselect" token="alloptions" searchWhenChanged="true">
      <label></label>
      <choice value="All">All</choice>
      <choice value="second_choice">second choice</choice>
      <choice value="third_choicee">third choice</choice>
      <choice value="fourth_choice">fourth choice</choice>
      <choice value="fifth_choicee">fifth choice</choice>
      <delimiter>,</delimiter>
      <change>
        <eval token="form.alloptions">case(mvcount('form.alloptions')=0,"All",mvcount('form.alloptions')&gt;1 AND mvfind('form.alloptions',"All")&gt;0,"All",mvcount('form.alloptions')&gt;1 AND mvfind('form.alloptions',"All")=0,mvfilter('form.alloptions'!="All"),1==1,'form.alloptions')</eval>
        <eval token="second">if(isnotnull(mvfind('form.alloptions',"second_choice")) OR isnotnull(mvfind('form.alloptions',"All")),1,null())</eval>
        <eval token="third">if(isnotnull(mvfind('form.alloptions',"third_choice")) OR isnotnull(mvfind('form.alloptions',"All")),1,null())</eval>
        <eval token="fourth">if(isnotnull(mvfind('form.alloptions',"fourth_choice")) OR isnotnull(mvfind('form.alloptions',"All")),1,null())</eval>
        <eval token="fifth">if(isnotnull(mvfind('form.alloptions',"fifth_choice")) OR isnotnull(mvfind('form.alloptions',"All")),1,null())</eval>
      </change>
    </input>
  </fieldset>
  <row>
    <panel depends="$second$">
      <html>
        <p>Second Panel</p>
      </html>
    </panel>
    <panel depends="$third$">
      <html>
        <p>Third Panel</p>
      </html>
    </panel>
    <panel depends="$fourth$">
      <html>
        <p>Fourth Panel</p>
      </html>
    </panel>
    <panel depends="$fifth$">
      <html>
        <p>Fifth Panel</p>
      </html>
    </panel>
  </row>
</form>
0 Karma

mnj1809
Path Finder

This given solution works perfectly. But my requirement is to use value="*" for "All" as I need to use this value in other panels. could you please share the updated dashboard xml having
<choice value="*">All</choice>

@ITWhisperer 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
<form version="1.1">
  <label>Multiselect Choice</label>
  <fieldset submitButton="false" autoRun="true">
    <input type="multiselect" token="alloptions" searchWhenChanged="true">
      <label></label>
      <choice value="*">All</choice>
      <choice value="second_choice">second choice</choice>
      <choice value="third_choice">third choice</choice>
      <choice value="fourth_choice">fourth choice</choice>
      <choice value="fifth_choice">fifth choice</choice>
      <delimiter>,</delimiter>
      <change>
        <eval token="form.alloptions">case(mvcount('form.alloptions')=0,"*",mvcount('form.alloptions')&gt;1 AND mvfind('form.alloptions',"\\*")&gt;0,"*",mvcount('form.alloptions')&gt;1 AND mvfind('form.alloptions',"\\*")=0,mvfilter('form.alloptions'!="*"),1==1,'form.alloptions')</eval>
        <eval token="second">if(isnotnull(mvfind('form.alloptions',"second_choice")) OR isnotnull(mvfind('form.alloptions',"\\*")),1,null())</eval>
        <eval token="third">if(isnotnull(mvfind('form.alloptions',"third_choice")) OR isnotnull(mvfind('form.alloptions',"\\*")),1,null())</eval>
        <eval token="fourth">if(isnotnull(mvfind('form.alloptions',"fourth_choice")) OR isnotnull(mvfind('form.alloptions',"\\*")),1,null())</eval>
        <eval token="fifth">if(isnotnull(mvfind('form.alloptions',"fifth_choice")) OR isnotnull(mvfind('form.alloptions',"\\*")),1,null())</eval>
      </change>
    </input>
  </fieldset>
  <row>
    <panel depends="$second$">
      <html>
        <p>Second Panel</p>
      </html>
    </panel>
    <panel depends="$third$">
      <html>
        <p>Third Panel</p>
      </html>
    </panel>
    <panel depends="$fourth$">
      <html>
        <p>Fourth Panel</p>
      </html>
    </panel>
    <panel depends="$fifth$">
      <html>
        <p>Fifth Panel</p>
      </html>
    </panel>
  </row>
</form>
0 Karma

mnj1809
Path Finder

Thank you so much. Works perfectly !!!
@ITWhisperer 

0 Karma
Get Updates on the Splunk Community!

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer at Splunk .conf24 ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...