Please use below screenshot to determine what Splunk query that is needed to display the access control under the panel: "Year Selection and Rating Results" For example, when you click on "AC-7" that is yellow color, you should see in column fields the following which is: System, FISMA-ID, FIPS199-Categorization, FIPS199-Rating, Control Library, YearOA(if the system is high, medium or low) and Compliance status(if the system compliance is high, medium or low)
Hi @ngwodo,
sorry but I don't understand what's your request: do you want to split details in more panels or what else?
Then, could you share your code instead of a screenshot? it's easier to help you.
Anyway, if you want to split the details panel in more panels, you could use a base search to populate all panels and put only a subset of fields in each panel.
Ciao.
Giuseppe
Thanks for your response. Here is my XML source code for the Dashboard below. I just want to show the details of one line of code when the access control e.g. "AC-1" depending on when the System name compliance status for each year or multiple years is either "high" or "medium" or "low"
The source code is:
<form version="1.1">
<label>RTM_Automation_030623_Global_David</label>
<fieldset submitButton="false">
<input type="dropdown" token="system_tk" searchWhenChanged="true">
<label>System Selection</label>
<fieldForLabel>System</fieldForLabel>
<fieldForValue>System</fieldForValue>
<search>
<query>|inputlookup controls_rtm.csv
|stats c by "System"
|table "System"
</query>
<earliest>0</earliest>
<latest></latest>
</search>
<choice value="*">All</choice>
<default>*</default>
</input>
<input type="dropdown" token="cl_tk" searchWhenChanged="true">
<label>Control Library Selection</label>
<fieldForLabel>Control_Library</fieldForLabel>
<fieldForValue>Control_Library</fieldForValue>
<search>
<query>|inputlookup controls_rtm.csv
|search "System"="$system_tk$"
|stats c by "Control Library"
|table "Control Library"
|rename "Control Library" as Control_Library</query>
<earliest>0</earliest>
<latest></latest>
</search>
<choice value="*">All</choice>
<default>*</default>
</input>
<input type="multiselect" token="year_tk" searchWhenChanged="true">
<label>Year OAM Selection</label>
<choice value="Year 1 OAM">Year 1</choice>
<choice value="Year 2 OAM">Year 2</choice>
<choice value="Year 3 OAM">Year 3</choice>
<delimiter>|</delimiter>
</input>
</fieldset>
<row>
<panel>
<html depends="$alwayshideCSSPanel$">
<style>
#tableColor table tbody td div.multivalue-subcell[data-mv-index="1"]{
display:none;
}
</style>
</html>
<table id="tableColor">
<title>Year Selection and Rating Results</title>
<search>
<query>|inputlookup controls_rtm.csv |search "System"="$system_tk$" "Control Library"="$cl_tk$"
|table [|inputlookup controls_rtm.csv |search "System"="$system_tk$" "Control Library"="$cl_tk$"
|fields - "System", "Control Library"
|eval yearoam="$year_tk$"
|makemv yearoam delim="|"
|mvexpand yearoam
|eval "FIPS199-Rating"=case('FIPS199-Rating'="H","High",'FIPS199-Rating'="M","Mod",'FIPS199-Rating'="L","Low")
|eval yearoam=yearoam." ".'FIPS199-Rating'
|table yearoam
|eval yearoam="\"".yearoam."\""
|stats values(yearoam) as yearoam delim=","
|nomv yearoam |rename yearoam as search], "Compliance Status"
|eval color =case('Compliance Status'>=0 AND 'Compliance Status'<25,"LOW",'Compliance Status'>=25 AND 'Compliance Status'<100,"MEDIUM",'Compliance Status'=100,"HIGH")
|foreach * [eval <<FIELD>>=mvappend('<<FIELD>>',color)]
|fields - color,"Compliance Status"</query>
<earliest>0</earliest>
<latest></latest>
</search>
<option name="drilldown">cell</option>
<option name="refresh.display">progressbar</option>
<format type="color">
<colorPalette type="expression">case (match(value,"LOW"), "#DC4E41",match(value,"MEDIUM"), "#F8BE34",match(value,"HIGH"),"#53A051")</colorPalette>
</format>
<drilldown>
<set token="field_name">$click.name2$</set>
<set token="field_value">$click.value2$</set>
</drilldown>
</table>
</panel>
</row>
<row>
<panel depends="$field_name$,$field_value$">
<table>
<title>RTM Data Table</title>
<search>
<query>|inputlookup controls_rtm.csv |table Column* *</query>
<earliest>0</earliest>
<latest></latest>
</search>
<option name="drilldown">cell</option>
<drilldown>
<link target="_blank">/app/CIS_OA/rtm_automation_030623_global_david?form.year_tk=$click.value$</link>
</drilldown>
</table>
</panel>
</row>
<row>
<panel>
<table>
<title>RTM Test Methods</title>
<search>
<query>| inputlookup AssetD.csv | table *</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="drilldown">cell</option>
<drilldown>
<link target="_blank">/app/CIS_OA/rtm_automation_030623_global_david?form.year_tk=$click.value2$</link>
</drilldown>
</table>
</panel>
</row>
</form>