I have "Product Brand" multiselect filter in a Splunk dashboard. It is a dynamic filter rather than static. I also have a panel displaying all product brands. Now, I want another conditional panel to...
See more...
I have "Product Brand" multiselect filter in a Splunk dashboard. It is a dynamic filter rather than static. I also have a panel displaying all product brands. Now, I want another conditional panel to display further information of 3 of the brands in the product brand list if user selects any of these 3. I know I have to set a <change> and <condition> tag in XML to toggle between the display of panel and store the selected values. I now write three condition tags with set token like this: <change>
<condition match="A">
<set token="show_product_panel">true</set>
<set token="show_product">$value$</set>
</condition>
<condition value="B">
<set token="show_product_panel">true</set>
<set token="show_product">$value$</set>
</condition>
<condition value="C">
<set token="show_product_panel">true</set>
<set token="show_product">$value$</set>
</condition>
<condition>
<unset token="show_product_panel"></unset>
<unset token="show_product"></unset>
</condition>
</change> However, I want the $show_product$ to hold multiple values instead of one, as it is a multiselect filter. How should I do so? I have tried something in each of the condition like but won't work. How can I "append" the values into $show_product$? Thanks. <eval token="show_product">if(isnull($show_product$), $value$, $show_product$.", ".$value$)</eval> FYI: the $show_product$ will be passed into the conditional panel like this <row depends="$show_product_panel$">
<panel>
<chart>
<search>
<query>index IN ("A_a", "A_b")
| where match(index, "A_" + $subsidiary$)
| dedup id sortby _time
| eval "Product Brand" = coalesce('someFieldA',
'someFieldB')
| search "Product Brand" IN ($show_product$)
| timechart span=1mon count by "Product Brand"</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>
<option name="charting.chart">column</option>
<option name="charting.drilldown">none</option>
<option name="refresh.display">progressbar</option>
</chart>
</panel>
</row> FYI: Product Brand XML code snippet: <input type="multiselect" token="product_brand" searchWhenChanged="true">
<label>Product Brand</label>
<fieldForLabel>brand_combine</fieldForLabel>
<fieldForValue>brand_combine</fieldForValue>
<search>
<query>index IN ("A","B")
| eval brand_combine = coalesce('someFieldA','someFieldB')
| search brand_combine != null
| where match(index, "zendesk_ticket_" + $subsidiary$)
| dedup brand_combine
| fields brand_combine</query>
<earliest>0</earliest>
<latest></latest>
</search>
<choice value="*">All</choice>
<default>*</default>
<initialValue>*</initialValue>
<delimiter>,</delimiter>
<change>
<condition match="A">
<set token="show_product_panel">true</set>
<set token="show_product">$value$</set>
</condition>
<condition value="B">
<set token="show_product_panel">true</set>
<set token="show_product">$value$</set>
</condition>
<condition value="C">
<set token="show_product_panel">true</set>
<set token="show_product">$value$</set>
</condition>
<condition>
<unset token="show_product_panel"></unset>
<unset token="show_product"></unset>
</condition>
</change>
</input>