Splunk Search

Can i display panel with Even or Odd Click on chart ?

akira2211
Explorer

Hi all,

Can i display left and right panel based on Even or Odd Click ?

For example,

I have a chart. And a row with title is "Comparison" including left panel and right panel.

So, my question is for even click(0,2,4,...) the left panel will be changed and the right panel was changed with odd click (1,3,5,...)

Example code,

 

 

<row>
	<panel depends="$ver$">
		<title>Here is the chart</title>
			<chart>
				<search>
					<query>index=idx MODEL IN ($model$) LOCAL=$location$ source="*"
					| dedup VERSION sortby -TOTALSIZE 
					| chart values(TOTALSIZE) by VERSION
					</query>
	        <earliest>$time.earliest$</earliest>
	        <latest>$time.latest$</latest>
	      </search>
	      <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
	      <option name="charting.axisLabelsX.majorLabelStyle.rotation">-45</option>
	      <option name="charting.axisY.abbreviation">none</option>
	      <option name="charting.chart">column</option>
	      <option name="charting.chart.showDataLabels">minmax</option>
	      <option name="charting.chart.stackMode">default</option>
	      <option name="charting.drilldown">all</option>
	      <option name="charting.legend.labelStyle.overflowMode">ellipsisEnd</option>
	      <option name="height">600</option>
	      <option name="refresh.display">progressbar</option>
	        
	      <drilldown>
	          <set token="version">$row.VERSION$</set>
	      </drilldown>
	        
	    </chart>
	</panel>
</row>
<row>
	<panel depends="$version$">
		<title>LEFT PANEL</title>
		<table>
			<search>
          <query>index=flash MODEL IN ($model$) LOCAL=$location source="*"
      | search VERSION&lt;$odd_click_verion$ 
      | stats count by VERSION 
      | sort -VERSION</query>
    	</search>
		</table>

	</panel>
	
	<panel depends="$version$">
		<title>RIGHT PANEL</title>
		<table>
			<search>
          <query>index=flash MODEL IN ($model$) LOCAL=$location source="*"
      | search VERSION&lt;$even_click_verion$ 
      | stats count by VERSION 
      | sort -VERSION</query>
    	</search>
		</table>
	</panel>
</row>

 

 

 appreciate for any help & comment 

 

Labels (2)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

Thinking out loud, but this could be done easily if the first chart was a <table> and you could number the rows with

 

| eval row=1
| accum row

 

and in the drilldown have

 

<drilldown>
  <eval token="even_click_version">if($row.row$%2=0,$row.row$,$even_click_version$)</eval>
  <eval token="odd_click_version">if($row.row$%2=1,$row.row$,$odd_click_version$)</eval>
</drilldown>

 

 

The full example,  but with searches that work in my data 

 

  <row>
    <panel>
      <title>Here is the chart</title>
      <table>
        <search>
          <query>index=location 
| chart values(tid) as v by type
| eval row=1
| accum row
          </query>
          <earliest>$time_range.earliest$</earliest>
          <latest>$time_range.latest$</latest>
        </search>
        <option name="drilldown">cell</option>
        <option name="refresh.display">progressbar</option>
        <drilldown>
          <eval token="even_click_version">if($row.row$%2=0,$row.type$,$even_click_version$)</eval>
          <eval token="odd_click_version">if($row.row$%2=1,$row.type$,$odd_click_version$)</eval>
          <set token="type">$row.type$</set>
        </drilldown>
        <fields>"type","v"</fields>
      </table>
    </panel>
  </row>
  <row>
    <panel depends="$type$">
      <title>LEFT PANEL</title>
      <table>
        <search>
          <query>index=location type=$even_click_version$
            | table type lat lon</query>
          <earliest>$time_range.earliest$</earliest>
          <latest>$time_range.latest$</latest>
        </search>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
    <panel depends="$type$">
      <title>RIGHT PANEL</title>
      <table>
        <search>
          <query>index=location type=$odd_click_version$
            | table type lat lon</query>
          <earliest>$time_range.earliest$</earliest>
          <latest>$time_range.latest$</latest>
        </search>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>

 

Problem is that <chart> does not support <fields> so you can't hide the row value used for the drilldown.

What you could do using the above principle, is to, for example, add the row to the version, with something like

 

| eval row=1
| accum row
| eval version=version."/".row

and then in the drilldown eval do

          <eval token="even_click_version">if(tonumber(replace($row.version$,".*/(\d+)","\1"))%2=0,tonumber(replace($row.version$,".*/(\d+)","\1")),$even_click_version$)</eval>
          <eval token="odd_click_version">if(tonumber(replace($row.version$,".*/(\d+)","\1"))%2=0,tonumber(replace($row.version$,".*/(\d+)","\1")),$odd_click_version$)</eval>

although I didn't manage to make that work, it _should_ be possible to eval that out

 

0 Karma

akira2211
Explorer

Thanks bowesmana, your reply really helpful. But I want display by click on the chart, it will be more convenient for user than table. 

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Sure, I wasn't suggested you use a table, just pointing out Splunk ways to achieve what you were trying to do

0 Karma

akira2211
Explorer

Anyone help please, should  I add an JS to counter this issue or xml have any function support that?

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Design, Compete, Win: Submit Your Best Splunk Dashboards for a .conf26 Pass

Hello Splunkers,  We’re excited to kick off a Splunk Dashboard contest! We know that dashboards are a primary ...

May 2026 Splunk Expert Sessions: Security & Observability

Level Up Your Operations: May 2026 Splunk Expert Sessions Whether you are refining your security posture or ...

Network to App: Observability Unlocked [May & June Series]

In today’s digital landscape, your environment is no longer confined to the data center. It spans complex ...