Splunk Search

How can I make use of a search string and token to display text in panels?

niftynicholas
New Member

I am developing a dashboard to analyze users logs from an email application. The dashboard has a Time (Time Picker) and Email (Drop-down List) as inputs. Users are able to select time range and a email in interest to drill down the different panels in the dashboard.

The email drop-down list consists of All (*), email1, email2, ..., etc). The token for this drop-down list is $email$.

alt text

When the user selects All, I would like some panels to show a message like "Further drilldown required". The reason is some panels are irrelevant when all emails are selected.

I know that I have to edit the various panels' search string use eval if(x,y,z) and the token $email$. However, I have no clue on how to start. One problem is, I am unable to use eval function at the start of a search string.

I appreciate help from you guys. Thank you in advance. 😄

Cheers!
- Nick

0 Karma
1 Solution

sundareshr
Legend

Try something like this

<form>
  <label>Filters</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="tok_email" searchWhenChanged="true">
      <label>Select Email</label>
      <change>
      <condition value="All">
        <set token="tok_errMsg">Further drill-down required</set>
      </condition>
      <condition value="*">
        <set token="tok_errMsg"> </set>
      </condition>
      </change>
      <choice value="One">One</choice>
      <choice value="Two">Two</choice>
      <choice value="Three">Three</choice>
      <choice value="All">All</choice>
      <default>All</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>$tok_errMsg$</title>

View solution in original post

randau9
New Member

You can also have a separate token that gets set when value=*, like so:

true

and unset when value=All:
`

0 Karma

sundareshr
Legend

Try something like this

<form>
  <label>Filters</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="tok_email" searchWhenChanged="true">
      <label>Select Email</label>
      <change>
      <condition value="All">
        <set token="tok_errMsg">Further drill-down required</set>
      </condition>
      <condition value="*">
        <set token="tok_errMsg"> </set>
      </condition>
      </change>
      <choice value="One">One</choice>
      <choice value="Two">Two</choice>
      <choice value="Three">Three</choice>
      <choice value="All">All</choice>
      <default>All</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>$tok_errMsg$</title>

niftynicholas
New Member

Hi sundareshr,

Thank you for your answer! You saved my day! It works good enough for me to present to my team.

Currently, "Further drill-down is required" is only reflected in the panel title. However, it would be better if the panels do no show any information but a line of text in order to prevent confusion.

Do you have a workaround? I'm really grateful for your help.

Cheers,
Nick

0 Karma

sundareshr
Legend

You can use the HTML panel for your title and use rejects on the panel that should be displayed conditionally

0 Karma
Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  &#x1f680; Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...