hi @niketnilay, It is already available from the existing query. At first I have shown everything in one table, but due to too many column, user would like to see whether can hide/unhide the column based on what they want to view. Thanks. ... View more

Thank you @p_gurav, it's worked well 🙂 ... View more

It's works. Learning something new today. Thanks 🙂 ... View more

Hi @493669, It's work! Thank you. Can you update as answer so that I can accept it officially? ... View more

Thank you @niketnilay for the guidance and help. I was in impression that the """ is equivalent to " ' " in xml. It is working great as expected result now. ... View more

Hi @niketnilay, Thanks for the reply. I've uploaded the dashboard image to https://imgur.com/izRwRbd I've tried both of these 2 condition match setting but it is not working. <condition match="$clicked_request$=='RequestA'"> <condition match="match($clicked_request$,'RequestA')"> Thanks for taking a look to my problem. ... View more

Hi @niketn, Thanks for the detailed explanation. I've a difficulty as the token to be conditionally matched is not from the panel itself. I pasted partial of the query for 2 panels as below. <form> <label>DAILY REPORT</label> <fieldset autoRun="false" submitButton="false"> <input type="time" token="date"> <label>DATE</label> <default> <earliest>@y</earliest> <latest>now</latest> </default> </input> </fieldset> <row> <panel> <title>DAILY VIEW based on Request A B C</title> <chart> <search> <query>index=* | rex field=_raw max_match=0 "RequestA\s\-\sCountry\:\s(?&lt;acountry&gt;[\w+]+)" | rex field=_raw max_match=0 "RequestB\s\-\sCountry\:\s(?&lt;bcountry&gt;[\w+]+)" | rex field=_raw max_match=0 "RequestC\s\-\sCountry\:\s(?&lt;ccountry&gt;[\w+]+)" | stats count(acountry) as "Request A", count(bcountry) as "Request B", count(ccountry) as "RequestC" by date_hour | sort date_hour</query> <earliest>$date.earliest$</earliest> <latest>$date.latest$</latest> </search> <option name="charting.chart">column</option> <option name="charting.drilldown">all</option> <option name="refresh.display">progressbar</option> <drilldown> <set token="show_panel">true</set> <set token="clicked_request">$click.name2$</set> <set token="clicked_time">$click.value$</set> </drilldown> </chart> </panel> </row> <row> <panel depends="$show_panel$"> <title>Country count based on $clicked_request$</title> <chart> <search> <query>index=* date_hour="$clicked_time$" | rex field=_raw max_match=0 "$clicked_request$.*Country\:\s(?&lt;country&gt;[^\s]+)" | chart count(date_hour) by country</query> <earliest>$date.earliest$</earliest> <latest>$date.latest$</latest> </search> <option name="charting.chart">pie</option> <option name="charting.drilldown">all</option> <option name="refresh.display">none</option> <drilldown> <condition match="$click.value$=='RequestA'"> <set token="Apanel">RequestA</set> <set token="clicked_country">$click.value$</set> <unset token="Bpanel"></unset> </condition> <!-- Else Condition always hit for RequestB--> <condition> <unset token="Apanel"></unset> <set token="Bpanel">"RequestB"</set> <set token="clicked_country">$click.value$</set> </condition> </drilldown> </chart> </panel> </row> <row> <panel depends="$Apanel$"> .... .... .... As you can see, clicked_request is from the first panel to display the total request based on date_hour. Once it is clicked, the next panel then will show the country count of that request. The challenge is for the third panel - which is a table with 2 input types (dropdown), and display the details of request A/B/C (based on clicked_request from first panel). How can I pass the value from panel 1 or is there better way to achieve this? Your help is very much appreciated. Thank you in advance. ... View more

I found a link: https://answers.splunk.com/answers/400053/condition-match-and-set-token-in-drilldown-not-wor-1.html Tried to form similar query but the next panel (panel_a or panel_b) is not displaying but it is showing the search dashboard with query in panel_a/panel_b. I really need some expertise advice here. <drilldown> <condition match="'click.name2' == 'RequestA'"> <set token="panel_a">true</set> <unset token="panel_b"></unset> </condition> <condition match="'click.name2' == 'RequestB'"> <set token="panel_b">true</set> <unset token="panel_a"></unset> </condition> </drilldown> ... View more

Thanks, the query after the panel1 is based on selection from the chart (RequestA displays tableA, RequestB displays tableB). Both tables are displaying different data. Just wondering how should I hide the panel for tableB if the selection received is requestA? ... View more

That's the exact question, how to set filter for the panel? I cannot use below setting but would like to achieve similar result. <panel depends="$clicked_request$" = "RequestA"> ... View more

Hi deepashri_123, eventstats just make the trick! Thank you as always. ... View more

Thank you @493669 for the great helps! It's work well in my dashboard. ... View more

Hi @deepashri, Thanks for the reply. I've reviewed the codes provided, it is mainly for the input source either from dropdown or bullet selection. My main panel(panel1) which showing request type is from the regex and it is showing as pie chart. The token set for this panel1 is <set token="clicked_request">$click.name2$</set> How can I set the condition of the next panel based on the $click.name2$? ... View more

Yes it is working fine now after several tests. Thanks to @mayurr98 and @493669. ... View more

Desired output in table format as explained in: https://answers.splunk.com/answers/624710/formatting-output-in-table.html ... View more

city token from dropdown list is extracted using regex to catch the "city" in the log. Sample log: Request_A - Country: GERMANY - City: BER ... View more

No it is not working. city token is from dropdown list. There is no such field "city=" in the log. My simplified query as below: index=* "Country: $clicked_country$ - CITY: $city$" | eval country=if((_raw LIKE "%$clicked_country$%"),"$clicked_country$","0") | eval city=if((_raw LIKE "%$city$%"),"$city$","0") | stats values(date_hour) as "Hour" by country city ... View more

hi @493669 and @deepashri, Both solution not working. There is no "city=" to be matched in the log. the $city$ field is from dropdown list (e.g. All, London, Mancester....etc). Solution provided by @493669 still returning as "*". ... View more