Splunk Search

How to run search only for shown panels?

naty
Path Finder

Hi,

i have a dashboard with several panels.
i have used the "depends" option for every panel to see only those that i need.

what i have noticed is even though i have this option, still all the panels would start the search as soon as the page loads and not when only shown.

meaning, when i open the dashboard i see nothing.
i'm inputting some data for tokens (interval, time, etc).
then i choose the panels i would like to show.
for each panel i have used the depends and rejects options to see only those that matter to that subject.
i have noticed that after inputting all the data needed, all the panels would make their search, no matter if the depends is on them.

my goal is that only that shown panels would start the search and show their output.
we are using Splunk 6.5.1

How can it be done?

Thank you!

Tags (1)
0 Karma

naty
Path Finder

i found a workaround for this.
i'm initializing the tokens at the page load, so no panel is shown for the start.
this is how i achieved it:

<form>
    <init>
        <unset token="a"></unset>
        <unset token="b"></unset>
        <unset token="c"></unset>
        ...

      </init>
</form>

in the tag you can initialize many things, here is a link to the tag description:
http://docs.splunk.com/Documentation/Splunk/latest/Viz/tokens#Set_tokens_on_page_load

0 Karma

somesoni2
Revered Legend

Best option would be to include the depends token that you used for panel in the panel search, so that searches will not run untill that token is set (and thus panel is visible). E.g. If you're setting a token say $showPanel1$ with value say "Y", then in the base search (first portion) of the panel search, add a condition "$showPanel1$"="Y".

0 Karma

naty
Path Finder

can you give an example?
if i got it right, you mean something like this:
index=myind source=mysrc "$showPanel1$"="Y" | ...
but doesn't interfere with the search? i'm basically saying to splunk to search for event with showPanel=Y

0 Karma

somesoni2
Revered Legend

It won't. When the token value is evaluated, your search will look like this and should always work.

index=myind source=mysrc "Y"="Y" | ...

Another (better IMO) option you could do is to set value of $showPanel1$ as 1, then your search would look like this

index=myind source=mysrc $showPanel1=1 | ...

Upon evaluation, results in 1=1 which is always true.

index=myind source=mysrc 1=1 | ...
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Thanks for the Memories! Splunk University, .conf25, and our Community

Thank you to everyone in the Splunk Community who joined us for .conf25, which kicked off with our iconic ...

Data Persistence in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. What happens if the OpenTelemetry collector ...

Introducing Splunk 10.0: Smarter, Faster, and More Powerful Than Ever

Now On Demand Whether you're managing complex deployments or looking to future-proof your data ...