Splunk Search

Need a dropdown and when i select one option only that related panels should display rest all panels should not display?

Vani_26
Path Finder

Need a dropdown and when i select one option only that related panels should display rest all panels should not display.
i have 7 panels(panel1, panel2.......panel7), i need to have one dropdown with 3 options(appID, appname, appdetails) options in it.
if i select appID from the dropdown,  3 panels should display(panel1, panel2 and panel3)
if i select appname from the dropdown, 2 panels should display(panel4, panel5)
if i select appdetails from the dropdown,  2 panels should display(panel6, panel7)

Please help me on this.

Labels (1)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

Use the 

<panel depends="$token$">

syntax. See here for documentation

https://docs.splunk.com/Documentation/Splunk/latest/Viz/PanelreferenceforSimplifiedXML

See this example and tailor it to your needs

<form>
  <label>dropdown</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="type" searchWhenChanged="true">
      <label>Type</label>
      <choice value="appId">appID</choice>
      <choice value="appname">appname</choice>
      <choice value="appdetails">appdetails</choice>
      <change>
        <condition value="appId">
          <set token="appId_panel"></set>
          <unset token="appname_panel"></unset>
          <unset token="appdetails_panel"></unset>
        </condition>
        <condition value="appname">
          <set token="appname_panel"></set>
          <unset token="appId_panel"></unset>
          <unset token="appdetails_panel"></unset>
        </condition>
        <condition value="appdetails">
          <set token="appdetails_panel"></set>
          <unset token="appname_panel"></unset>
          <unset token="appId_panel"></unset>
        </condition>
      </change>
    </input>
  </fieldset>
  <row>
    <panel depends="$appId_panel$">
      <table>
        <search>
          <query>
          | makeresults 
          | eval panel="appId"
        </query>
        </search>
      </table>
    </panel>
    <panel depends="$appname_panel$">
      <table>
        <search>
          <query>
          | makeresults 
          | eval panel="appname"
        </query>
        </search>
      </table>
    </panel>
    <panel depends="$appdetails_panel$">
      <table>
        <search>
          <query>
          | makeresults 
          | eval panel="appdetails"
        </query>
        </search>
      </table>
    </panel>
  </row>
</form>

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

Use the 

<panel depends="$token$">

syntax. See here for documentation

https://docs.splunk.com/Documentation/Splunk/latest/Viz/PanelreferenceforSimplifiedXML

See this example and tailor it to your needs

<form>
  <label>dropdown</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="type" searchWhenChanged="true">
      <label>Type</label>
      <choice value="appId">appID</choice>
      <choice value="appname">appname</choice>
      <choice value="appdetails">appdetails</choice>
      <change>
        <condition value="appId">
          <set token="appId_panel"></set>
          <unset token="appname_panel"></unset>
          <unset token="appdetails_panel"></unset>
        </condition>
        <condition value="appname">
          <set token="appname_panel"></set>
          <unset token="appId_panel"></unset>
          <unset token="appdetails_panel"></unset>
        </condition>
        <condition value="appdetails">
          <set token="appdetails_panel"></set>
          <unset token="appname_panel"></unset>
          <unset token="appId_panel"></unset>
        </condition>
      </change>
    </input>
  </fieldset>
  <row>
    <panel depends="$appId_panel$">
      <table>
        <search>
          <query>
          | makeresults 
          | eval panel="appId"
        </query>
        </search>
      </table>
    </panel>
    <panel depends="$appname_panel$">
      <table>
        <search>
          <query>
          | makeresults 
          | eval panel="appname"
        </query>
        </search>
      </table>
    </panel>
    <panel depends="$appdetails_panel$">
      <table>
        <search>
          <query>
          | makeresults 
          | eval panel="appdetails"
        </query>
        </search>
      </table>
    </panel>
  </row>
</form>

Vani_26
Path Finder

@bowesmana , Excellent!!!!
It worked, thank you 

0 Karma
Get Updates on the Splunk Community!

Cisco Use Cases, ITSI Best Practices, and More New Articles from Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Build Your First SPL2 App!

Watch the recording now!.Do you want to SPL™, too? SPL2, Splunk's next-generation data search and preparation ...

Exporting Splunk Apps

Join us on Monday, October 21 at 11 am PT | 2 pm ET!With the app export functionality, app developers and ...