Splunk Search

When viewing a dashboard, how to control what panels run?

Motivator

I have the below very simple dashboard for illustration. (assume a chart would be in row 2 and row 3)
My question is, do panels in row 2 and row 3 run when I visit the dashboard? What I mean is, if there was a chart in row 2 and row 3, do the charts get built when I visit the dashboard, thereby on ticking the selectbox will open the charts that are already running?

Or does the search for the charts in row 2 and 3 not run until the selectbox is ticked after visiting the dashboard? This is what I would like to achieve.

  <form>
    <label>shoing and hiding rows Clone</label>
    <description>showing and hiding rows description https://answers.splunk.com/answers/298909/is-there-a-tagname-i-can-use-in-simple-xml-that-i.html</de...;
    <row>
        <panel>
            <html>
                 <h1>this is a h1</h1>


            </html>
        </panel>
    </row>
    <row>
        <panel>
            <input type="checkbox" token="show_token" searchWhenChanged="true">
            <choice value="show">show rows 2 and 3</choice>
            </input>
        </panel>
    </row>
    <row depends="$show_token$">
        <panel>
            <html>
                 <h2>this is a h2 </h2>


            </html>
        </panel>
    </row>
    <row depends="$show_token$">
        <panel>
            <html>
                 <h3>this is a h3 </h3>


            </html>
        </panel>
    </row>
</form>

Maybe I have to use fieldset to offer more control?

<fieldset autoRun="true" submitButton="true">
    <input type="checkbox" token="show_token" searchWhenChanged="true">
    <choice value="show">show rows 2 and 3</choice>
    </input>
</fieldset>

NOTE similar/related question here

Revered Legend

The depends option only control the visibility of the panel. The panel will still run at dashboard load, depending upon the search (if it needs any token to be set it, then will not run till that time).

If you want to have your panel searches run only after that token /checkbox is selected, then you need to include that token (which you used in depends) to your search as well so that the search will run until that token is set.

You can set the token value of $show_token$ to something which will always be true/satisfied in the search string, e.g. 1=1

 <input type="checkbox" token="show_token" searchWhenChanged="true">
             <choice value="1=1">show rows 2 and 3</choice>
             </input>

Path Finder

Hi,
Can you explain me little bit more on using value="1=1"? My code looks like below.

<form>
  <label>Transaction Search</label>
  <fieldset autoRun="false" submitButton="true">
    <input type="dropdown" token="Tran_Type">
      <label>TRANSACTION TYPE</label>
      <choice value="inward">INWARD</choice>
      <choice value="outward">OUTWARD</choice>
      <default>outward</default>
      <change>
        <condition value="outward">
          <set token="out">*</set>
          <unset token="income"></unset>
        </condition>
        <condition value="inward">
          <set token="income">*</set>
          <unset token="out"></unset>
        </condition>
      </change>
    </fieldset>
   <row>
    <panel depends="$out$">
      <table>
        <search>
          <query>index=idx_#####_db ------------------------- </query>
      </table>
    </panel>
    <panel depends="$income$">
      <table>
        <search>
          <query>index=idx_#####_log ------------------------- </query>
      </table>
    </panel>
  </row>
</form>
0 Karma

Motivator

Fixed your code for you. Or it works at least. THe submit is redundant or does not work. Hope it may help!

<form>
   <label>Transaction Search</label>
   <fieldset autoRun="false" submitButton="true">
     <input type="dropdown" token="Tran_Type">
       <label>TRANSACTION TYPE</label>
       <choice value="inward">INWARD</choice>
       <choice value="outward">OUTWARD</choice>
       <default>outward</default>

      <change>
         <condition value="outward">
           <set token="out">*</set>
           <unset token="income"></unset>
         </condition>
         <condition value="inward">
           <set token="income">*</set>
           <unset token="out"></unset>
         </condition>
      </change>

       </input>

     </fieldset>
    <row>
     <panel depends="$out$">
       <html>
       <h1> test OUTWARD</h1>
       </html>
     </panel>
     <panel depends="$income$">
       <html>
       <h1> test INWARD</h1>
       </html>
     </panel>
   </row>
 </form>
0 Karma

Legend

If you move the depends=$show_true$ to the <panel> tag, the two panels will not show till the token show_token is set. In your example, that will happen only when user clicks on the checkbox. So when the dashboards loads, the panels will not be visible.

Motivator

this is slightly related and may be useful http://i-splunk.blogspot.co.nz/2014/03/toggle-splunk-panels.html - has more to do with panels in html

0 Karma

Path Finder

link not working.

0 Karma

Motivator

link works for me now.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!