Splunk Search

Help putting a condition match for a search with three possible results to show/hide either both or one of two panels

jaffar20
Explorer

I'm trying to either hide or show two panels depending on a search result from a different panel which will have 3 options.

E.g. If the result is "A" I want both panels to show, If "B" then just one panel, and if "C" then just the other panel.

I don't want to use my actual search in case a google search leads to my companies product but I've done the condition that the other panel is dependant on like this:

<condition match="'Letter' == &quot;A&quot;">
  <set token="show_panel_1">true</set>
  <set token="show_panel_2">true</set>
</condition>
<condition>
  <unset token="show_panel_1"></unset>
  <unset token="show_panel_2"></unset>
</condition>
<condition match="'Letter' == &quot;B&quot;">
  <set token="show_panel_1">true</set>
</condition>
<condition>
  <unset token="show_panel_1"></unset>
  <unset token="show_panel_2"></unset>
</condition>
<condition match="'Letter' == &quot;C&quot;">
  <set token="panel_show_2">true</set>
</condition>
<condition>
  <unset token="show_panel_1"></unset>
  <unset token="show_panel_2"></unset>`

And the panels two panels are done as,

<panel depends="$show_panel_1$">

and

<panel depends="$show_panel_2$">

However, both panels are hidden regardless of the result. What did I do wrong? I've seen other examples online used the unset so that's why I used it, but even when I try removing it or just putting it at the end, it still doesn't work.

0 Karma
1 Solution

jaffar20
Explorer

Solved it: it was the field name being in quotes

View solution in original post

0 Karma

jaffar20
Explorer

Solved it: it was the field name being in quotes

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...