Re: When viewing a dashboard, how to control what ...

HattrickNZ · ‎10-14-2015

I have the below very simple dashboard for illustration. (assume a chart would be in row 2 and row 3)
My question is, do panels in row 2 and row 3 run when I visit the dashboard? What I mean is, if there was a chart in row 2 and row 3, do the charts get built when I visit the dashboard, thereby on ticking the selectbox will open the charts that are already running?

Or does the search for the charts in row 2 and 3 not run until the selectbox is ticked after visiting the dashboard? This is what I would like to achieve.

  <form>
    <label>shoing and hiding rows Clone</label>
    <description>showing and hiding rows description https://answers.splunk.com/answers/298909/is-there-a-tagname-i-can-use-in-simple-xml-that-i.html</de...;
    <row>
        <panel>
            <html>
                 <h1>this is a h1</h1>


            </html>
        </panel>
    </row>
    <row>
        <panel>
            <input type="checkbox" token="show_token" searchWhenChanged="true">
            <choice value="show">show rows 2 and 3</choice>
            </input>
        </panel>
    </row>
    <row depends="$show_token$">
        <panel>
            <html>
                 <h2>this is a h2 </h2>


            </html>
        </panel>
    </row>
    <row depends="$show_token$">
        <panel>
            <html>
                 <h3>this is a h3 </h3>


            </html>
        </panel>
    </row>
</form>

Maybe I have to use fieldset to offer more control?

<fieldset autoRun="true" submitButton="true">
    <input type="checkbox" token="show_token" searchWhenChanged="true">
    <choice value="show">show rows 2 and 3</choice>
    </input>
</fieldset>

NOTE similar/related question here

somesoni2 · ‎05-10-2016

The depends option only control the visibility of the panel. The panel will still run at dashboard load, depending upon the search (if it needs any token to be set it, then will not run till that time).

If you want to have your panel searches run only after that token /checkbox is selected, then you need to include that token (which you used in depends) to your search as well so that the search will run until that token is set.

You can set the token value of $show_token$ to something which will always be true/satisfied in the search string, e.g. 1=1

 <input type="checkbox" token="show_token" searchWhenChanged="true">
             <choice value="1=1">show rows 2 and 3</choice>
             </input>

anantdeshpande · ‎07-31-2017

Hi,
Can you explain me little bit more on using value="1=1"? My code looks like below.

<form>
  <label>Transaction Search</label>
  <fieldset autoRun="false" submitButton="true">
    <input type="dropdown" token="Tran_Type">
      <label>TRANSACTION TYPE</label>
      <choice value="inward">INWARD</choice>
      <choice value="outward">OUTWARD</choice>
      <default>outward</default>
      <change>
        <condition value="outward">
          <set token="out">*</set>
          <unset token="income"></unset>
        </condition>
        <condition value="inward">
          <set token="income">*</set>
          <unset token="out"></unset>
        </condition>
      </change>
    </fieldset>
   <row>
    <panel depends="$out$">
      <table>
        <search>
          <query>index=idx_#####_db ------------------------- </query>
      </table>
    </panel>
    <panel depends="$income$">
      <table>
        <search>
          <query>index=idx_#####_log ------------------------- </query>
      </table>
    </panel>
  </row>
</form>

HattrickNZ · ‎12-11-2019

Fixed your code for you. Or it works at least. THe submit is redundant or does not work. Hope it may help!

<form>
   <label>Transaction Search</label>
   <fieldset autoRun="false" submitButton="true">
     <input type="dropdown" token="Tran_Type">
       <label>TRANSACTION TYPE</label>
       <choice value="inward">INWARD</choice>
       <choice value="outward">OUTWARD</choice>
       <default>outward</default>

      <change>
         <condition value="outward">
           <set token="out">*</set>
           <unset token="income"></unset>
         </condition>
         <condition value="inward">
           <set token="income">*</set>
           <unset token="out"></unset>
         </condition>
      </change>

       </input>

     </fieldset>
    <row>
     <panel depends="$out$">
       <html>
       <h1> test OUTWARD</h1>
       </html>
     </panel>
     <panel depends="$income$">
       <html>
       <h1> test INWARD</h1>
       </html>
     </panel>
   </row>
 </form>

sundareshr · ‎05-10-2016

If you move the depends=$show_true$ to the <panel> tag, the two panels will not show till the token show_token is set. In your example, that will happen only when user clicks on the checkbox. So when the dashboards loads, the panels will not be visible.

HattrickNZ · ‎10-15-2015

this is slightly related and may be useful http://i-splunk.blogspot.co.nz/2014/03/toggle-splunk-panels.html - has more to do with panels in html

smudge797 · ‎05-09-2016

link not working.

HattrickNZ · ‎12-11-2019

link works for me now.

When viewing a dashboard, how to control what panels run?

Enterprise Security Content Update (ESCU) | New Releases

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

Index This | What are the 12 Days of Splunk-mas?