Splunk Search

Panels take time to change

NS
Explorer

Hi All,

I am trying to display panel-One when selected One from the dropdown option, and panel-Two when selected Two from the dropdown option, and so on. It was working perfectly fine until last week, but now the issue is:

When i select dropdown option One, no panel is displayed, when i select Two, Panel-One is displayed, and later when i select Three, the last selected dropdown option panel is selected, ie. Two.

Can someone urgently help please? My dashboard is completely messed up now, and I cant figure out where the actual problem is.

Many thanks in advance 🙂

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Your problem is with line 65!

Only joking! It would help us help you if you provided your Simple XML!

0 Karma

NS
Explorer

Here is the XML:

 

<input type="dropdown" token="theme">
<label>Theme</label>
<choice value="one">Panel One</choice>
<choice value="two">Panel Two</choice>
<choice value="three">Panel Three</choice>
<choice value="four">Panel Four</choice>
<choice value="five">Panel Five</choice>
<change>
<condition match="$theme$==&quot;one&quot;">
<set token="one">1</set>
<unset token="two"></unset>
<unset token="three"></unset>
<unset token="four"></unset>
<unset token="five"></unset>
</condition>
<condition match="$theme$==&quot;two&quot;">
<set token="two">1</set>
<unset token="one"></unset>
<unset token="three"></unset>
<unset token="four"></unset>
<unset token="five"></unset>
</condition>

.

.

.

and so on, for all five panels
</change>

 

Later under each panel, am assigning the token:

<row>
<panel depends="$one$">

.........

</panel>

</row>

 

Kindly help!

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You could try something like this

<input type="dropdown" token="theme">
<label>Theme</label>
<choice value="one">Panel One</choice>
<choice value="two">Panel Two</choice>
<choice value="three">Panel Three</choice>
<choice value="four">Panel Four</choice>
<choice value="five">Panel Five</choice>
<change>
<condition match="$theme$==&quot;one&quot;">
<set token="one">1</set>
</condition>
<condition>
<unset token="one"></unset>
</condition>
</change>
<change>
<condition match="$theme$==&quot;two&quot;">
<set token="two">2</set>
</condition>
<condition>
<unset token="two"></unset>
</condition>
</change>
<change>
<condition match="$theme$==&quot;three&quot;">
<set token="three">3</set>
</condition>
<condition>
<unset token="three"></unset>
</condition>
</change>
<change>
<condition match="$theme$==&quot;four&quot;">
<set token="four">4</set>
</condition>
<condition>
<unset token="four"></unset>
</condition>
</change>
<change>
<condition match="$theme$==&quot;five&quot;">
<set token="five">5</set>
</condition>
<condition>
<unset token="five"></unset>
</condition>
</change>
0 Karma

NS
Explorer

I tried this, it worked while i tested it the first time, and then the same issue continued after i refreshed the dashboard. Please help !

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You could try adding an unset of theme to each change block

<unset token="theme"></unset>
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Observability Simplified: Combining User Experience, Application Performance & ...

Tech Talk Observability Simplified: Combining User Experience, Application Performance & Network ...

Event Series May & June: From Network Visibility to Service Intelligence

Unifying the Network: Moving from Alert Noise to Service Intelligence with Splunk ITSI In today’s hybrid ...

Global Splunk User Group Events: May + June 2026

Your Splunk Community Awaits: Discover Upcoming User Group Events Worldwide    Staying ahead in the fast-paced ...