Splunk Search

How to run search only for shown panels?

naty
Path Finder

Hi,

i have a dashboard with several panels.
i have used the "depends" option for every panel to see only those that i need.

what i have noticed is even though i have this option, still all the panels would start the search as soon as the page loads and not when only shown.

meaning, when i open the dashboard i see nothing.
i'm inputting some data for tokens (interval, time, etc).
then i choose the panels i would like to show.
for each panel i have used the depends and rejects options to see only those that matter to that subject.
i have noticed that after inputting all the data needed, all the panels would make their search, no matter if the depends is on them.

my goal is that only that shown panels would start the search and show their output.
we are using Splunk 6.5.1

How can it be done?

Thank you!

Tags (1)
0 Karma

naty
Path Finder

i found a workaround for this.
i'm initializing the tokens at the page load, so no panel is shown for the start.
this is how i achieved it:

<form>
    <init>
        <unset token="a"></unset>
        <unset token="b"></unset>
        <unset token="c"></unset>
        ...

      </init>
</form>

in the tag you can initialize many things, here is a link to the tag description:
http://docs.splunk.com/Documentation/Splunk/latest/Viz/tokens#Set_tokens_on_page_load

0 Karma

somesoni2
Revered Legend

Best option would be to include the depends token that you used for panel in the panel search, so that searches will not run untill that token is set (and thus panel is visible). E.g. If you're setting a token say $showPanel1$ with value say "Y", then in the base search (first portion) of the panel search, add a condition "$showPanel1$"="Y".

0 Karma

naty
Path Finder

can you give an example?
if i got it right, you mean something like this:
index=myind source=mysrc "$showPanel1$"="Y" | ...
but doesn't interfere with the search? i'm basically saying to splunk to search for event with showPanel=Y

0 Karma

somesoni2
Revered Legend

It won't. When the token value is evaluated, your search will look like this and should always work.

index=myind source=mysrc "Y"="Y" | ...

Another (better IMO) option you could do is to set value of $showPanel1$ as 1, then your search would look like this

index=myind source=mysrc $showPanel1=1 | ...

Upon evaluation, results in 1=1 which is always true.

index=myind source=mysrc 1=1 | ...
0 Karma
Get Updates on the Splunk Community!

Unlock Database Monitoring with Splunk Observability Cloud

  In today’s fast-paced digital landscape, even minor database slowdowns can disrupt user experiences and ...

Purpose in Action: How Splunk Is Helping Power an Inclusive Future for All

At Cisco, purpose isn’t a tagline—it’s a commitment. Cisco’s FY25 Purpose Report outlines how the company is ...

[Upcoming Webinar] Demo Day: Transforming IT Operations with Splunk

Join us for a live Demo Day at the Cisco Store on January 21st 10:00am - 11:00am PST In the fast-paced world ...