Splunk Search

How to change Inline Search based on the click.value in Simple XML?

theouhuios
Motivator

Hello

I am trying to implement an inline chart whose search criteria will change based on the $click.value$ on the table.

Example:

Table

Column-A   Column-B
ABC          456456
NBH          5635635

Drilldown will be based on the value of $row.Column-A$

Now the inline search should change based on whether the value selected is ABC or NBC

IF $row.Column-A$=ABC

<chart>
index=blah sourcetype=blah ...|timechart
</chart>


 IF $row.Column-A$=NBC 

   <chart>
    index=blah2 sourcetype=blah2 ...|timechart
    </chart>

Is it possible to toggle the depend field like this? Any Ideas?

0 Karma

gyslainlatsa
Motivator

hi theouhuios,
try like this and let me know if this solves your problem

<form>
  <label>In-Page Drilldown</label>
  <description/>
  <fieldset submitButton="false">
    <!--
            Create an input to store the drilldown value. It will be hidden using custom javascript when
            the dashboard is loaded.
         -->

    <input type="text" token="Column_A" searchWhenChanged="true"/>
  </fieldset>

  <row>
    <table id="master">
      <title>Display </title>
      <searchString>index=index_name sourcetype=sourcetype_file |table Column_A  Column_B</searchString>
      <!-- Set the type of of drilldown, since we will always consume the same field, use row-->
      <option name="drilldown">row</option>
      <drilldown>
        <!-- Use set to specify the new token to be created.
                     Use any token from the page or from the click event to produce the value needed. -->
        <set token="Column_A ">$row.Column_A$</set>
        <!-- If we also set the form.sourcetype the input will get updated too -->
        <set token="form.Column_A ">$row.Column_A$</set>
      </drilldown>
    </table>
  </row>

  <row>

   <panel id="detail" depends="$Column_A$">
     <title>Column_A=$Column_A$ </title>

     <input type="dropdown" token="newstatus" searchWhenChanged="true">
        <label>Change the value of Column_A</label>
        <choice value="ABC">ABC</choice>
        <choice value="NBH">NBH</choice>
        <default></default>

        <change>
          <condition value="ABC">
            <set token="new_search">index=index_name sourcetype=sourcetype_file  Column_A=$Column_A$ |timechart count </set>
          </condition>

          <condition value="NBH">
            <set token="new_search">index=index_name sourcetype=sourcetype_file  Column_A=$Column_A$ |timechart count by Column_B</set>
          </condition>
        </change>
  </input>

      <chart>
        <title>change the chart depending on the value of Column_A</title>
        <search>
          <query>$new_search$</query>
        </search>
      </chart>

   </panel>

  </row>
</form>
0 Karma

hiteshkanchan
Communicator

I tried using the same but when I use "change" and "condition" it is not able to get the query and i get the message as "No search query Provided". Any idea if it is version issue or something else. I am currently using 6.1.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Build the Future of Agentic AI: Join the Splunk Agentic Ops Hackathon

AI is changing how teams investigate incidents, detect threats, automate workflows, and build intelligent ...

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...