how to enable Annotation based on token value.

[AKG1_old1]

Hello,

I am using event Annotation on timechart. but I want to activate only in case of specific services/ based on some token value.

Is there a way to enable/disable annotation based on token value ?

Thanks

[DalJeanis]

@niketnilay answered this one, but you can extend his suggestion so that you don't get any errors.

There are at least four ways.

A) You can use the selected service name to build different SPL for the annotation search inside a second token.

B) You can use the selected service to put the name of a different annotation base search into a token that will load your panel... and have one empty search for the purpose of loading "no" events.

C) You can build two different panels, one with the annotation search and one without, and use a token with depends/rejects to decide which panel to show.

D) You can set your annotation search itself up so that it returns no events when you don't want any annotations, and avoid all the above overhead.

---

A) You can use the selected service name to build different SPL for the annotation search inside a second token.

<input type="dropdown" token="tok_service">
  <label>Select a Service</label>
  <search base="myservices">
    <query />
  </search>
  <fieldForLabel>service</fieldForLabel>
  <fieldForValue>service</fieldForValue>

  <change>
    <condition match=" $tok_service$ == &quot;ServiceName1&quot; ">
          <set token="myannotationSPL">The SPL you want for Service Name 1 </set>
    </condition> 
    <condition>  
            <set token="myannotationSPL">The default SPL you want</set>
    </condition> 
  </change>
</input>

B) You can use the selected service to put the name of the base search into a token that will load your panel... and have one empty search for the purpose of loading "no" events

<search id="BaseSearchName1">
  <query>
      The SPL you want for Service Name 1 
  </query>
  <earliest></earliest>
  <latest></latest>
</search>

<search id="BaseSearchName2">
   <query>
      The default SPL you want
   </query>
  <earliest></earliest>
  <latest></latest>
</search>


<input type="dropdown" token="tok_service">
  <label>Select a Service</label>
  <search base="myservices">
    <query />
  </search>
  <fieldForLabel>service</fieldForLabel>
  <fieldForValue>service</fieldForValue>

  <change>
    <condition match=" $tok_service$ == &quot;ServiceName1&quot; ">
          <set token="annotationBase">BaseSearchName1</set>
    </condition> 
    <condition>  
          <set token="annotationBase">BaseSearchName2</set>
    </condition> 
  </change>
</input>

---

C) you can build two different panels, one with the annotation search and one without, and use a token with depends/rejects to decide which one to show.

---

D) You can set your annotation search itself up so that it returns no events when you don't want any annotations, and avoid all the above overhead.

[niketn]

@agoyal one crude way would be to add token dependency to annotation search so that it does not run when the token is not set. However, doing so, Splunk UI will show a warning message that Annotation Search is waiting for input. You can use jQuery to hide this warning based on text.

Refer to the following answer where I have used comment() macro to add token dependency to a search without impacting search performance: https://answers.splunk.com/answers/683826/how-do-you-set-the-order-of-queries-to-be-run-in-a.html

Please try out and confirm if this would work!