Splunk Search

Panel based on dropdown value

Muthu_Vinith
Path Finder

Hi Experts,

I am encountering an issue  with using filter tokens in specific row on my dashboard. I have two filters named ABC and DEF, tokens represented for ABC is $abc$ and DEF is $def$. 

I want to pass these tokens only to one specific row, while for others, I want to reject them. 

For the rows where i need to pass the tokens, I've used the following syntax: <row depends="$abc$ $def$"></row>

For the row where i don't want to use the token, I've used the following syntax; <row rejects="$abc$ $def$"></row>.

However when i use the rejects condition, the rows are hidden. I want these rows to still be visible.

Could someone please advise on how to resolve this issue?  I would appreciate every help. Thank you in advance!

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Just use one token - if necessary, use the <change> construct in your filters to set/unset a third token GHI $ghi$ based on whether $abc$ and/or $def$ are set

0 Karma

Muthu_Vinith
Path Finder

So in that case we don't want to use reject condition in the row right? @ITWhisperer 

Could you please share sample query for reference?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Please share your current dashboard source (or at least a cutdown version showing your filters, rows and panels)

0 Karma
Get Updates on the Splunk Community!

See Splunk Platform & Observability Innovations at Cisco Live EMEA

Hi Splunkers, Learn about what’s next for Splunk Platform at Cisco Live EMEA.  Data silos are a big challenge ...

The OpenTelemetry Certified Associate (OTCA) Exam

What’s this OTCA exam? The Linux Foundation offers the OpenTelemetry Certified Associate (OTCA) credential to ...

From Manual to Agentic: Level Up Your SOC at Cisco Live

Welcome to the Era of the Agentic SOC   Are you tired of being a manual alert responder? The security ...