Dashboards & Visualizations

How to display panel based on the value of a search?

Barty
Explorer

Good morning all,

I'm hoping someone may be able to assist me quickly and easily. I have a dashboard that shows a number of panels that return a status of batch jobs. Thing is, these batch jobs only run at 1:30pm and 4pm. As such, to make the dashboard a little more dynamic, I'd like to hide the panels for 1:30pm prior to the time being 1:30pm and likewise for 4pm. 

I have a hidden search that calculates current date and time, then I create two fields called time_check1 and time_check2. These two fields have a value of Yes or No depending on whether time_check1 is before 1:30pm (Yes, No) and likewise the second checks if it is before 4pm.

Now, what I want to do is only show the 1:30pm panels when time_check1 is = Yes, and the same again for 4pm panels when time_check2 is Yes. I have done a fair amount of searching through here and can see lots of questions about utilising dropdowns and inputs for this, but mine is a static hidden search that I simply need to display the panels when criteria is met (the value of Yes). 

Would anyone please be able to assist me? I'm sure there must be something along the lines of <panel depends="$time_check1$=YES"> or similar?

Thank you in advance.

Labels (4)
Tags (2)
0 Karma
1 Solution

@Barty you would need to take care of token assignment in your independent search event handler itself. How depends and rejects works is based on whether the token is set or it is null. It does not work based on what value does the token have.

Following is a run anywhere search that should set the required tokens. PS I am setting a third token for other time which do not match either of the time criteria you mentioned.

 

  <search>
    <query>| makeresults
| eval HourMinute=strftime(now(),"%H:%M:%S")
| eval time=case(HourMinute&gt;="13:30:00" AND HourMinute&lt;"16:00:59","Afternoon",HourMinute&gt;="16:00:00" AND HourMinute&lt;"23:59:59", "Evening",true(),"Morning")
    </query>
    <earliest>-1s</earliest>
    <latest>now</latest>
    <done>
      <condition match="$result.time$==&quot;Afternoon&quot;">
        <set token="time">$result.time$</set>
        <set token="showAfternoonPanel">true</set>
        <unset token="showEveningPanel"></unset>
        <unset token="showMorningPanel"></unset>
      </condition>
      <condition match="$result.time$==&quot;Evening&quot;">
        <set token="time">$result.time$</set>
        <unset token="showAfternoonPanel"></unset>
        <set token="showEveningPanel">true</set>
        <unset token="showMorningPanel"></unset>
      </condition>
      <condition>
        <set token="time">$result.time$</set>
        <unset token="showAfternoonPanel"></unset>
        <unset token="showEveningPanel"></unset>
        <set token="showMorningPanel">true</set>
      </condition>
    </done>
  </search>

 

Following is the Panel code for you to test the above code...

  <row>
    <panel depends="$showAfternoonPanel$">
      <html>$time$ Panel</html>
    </panel>
    <panel depends="$showEveningPanel$">
      <html>$time$ Panel</html>
    </panel>
    <panel depends="$showMorningPanel$">
      <html>$time$ Panel</html>
    </panel>
  </row>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

@Barty you would need to take care of token assignment in your independent search event handler itself. How depends and rejects works is based on whether the token is set or it is null. It does not work based on what value does the token have.

Following is a run anywhere search that should set the required tokens. PS I am setting a third token for other time which do not match either of the time criteria you mentioned.

 

  <search>
    <query>| makeresults
| eval HourMinute=strftime(now(),"%H:%M:%S")
| eval time=case(HourMinute&gt;="13:30:00" AND HourMinute&lt;"16:00:59","Afternoon",HourMinute&gt;="16:00:00" AND HourMinute&lt;"23:59:59", "Evening",true(),"Morning")
    </query>
    <earliest>-1s</earliest>
    <latest>now</latest>
    <done>
      <condition match="$result.time$==&quot;Afternoon&quot;">
        <set token="time">$result.time$</set>
        <set token="showAfternoonPanel">true</set>
        <unset token="showEveningPanel"></unset>
        <unset token="showMorningPanel"></unset>
      </condition>
      <condition match="$result.time$==&quot;Evening&quot;">
        <set token="time">$result.time$</set>
        <unset token="showAfternoonPanel"></unset>
        <set token="showEveningPanel">true</set>
        <unset token="showMorningPanel"></unset>
      </condition>
      <condition>
        <set token="time">$result.time$</set>
        <unset token="showAfternoonPanel"></unset>
        <unset token="showEveningPanel"></unset>
        <set token="showMorningPanel">true</set>
      </condition>
    </done>
  </search>

 

Following is the Panel code for you to test the above code...

  <row>
    <panel depends="$showAfternoonPanel$">
      <html>$time$ Panel</html>
    </panel>
    <panel depends="$showEveningPanel$">
      <html>$time$ Panel</html>
    </panel>
    <panel depends="$showMorningPanel$">
      <html>$time$ Panel</html>
    </panel>
  </row>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

yvassilyeva
Path Finder

@niketn-deceased 

How can I show panel dynamically? In this example you manually set the result, but what if I want to display the panel based on the result of the search that was picked from dropdown?

Scenario:
I have a dropdown with options: East, West, South and North. When i pick East from my dropdown and East populates in my panel, i'd like to show my panel. However if East is not populated in my search i want to hide the panel. Is there a way to do it dynamically?

 

Thank you.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

This is an old question with an accepted answer so it's unlikely many will see your question.  I suggest you post a new question.

BTW, niketnilay is no longer with us so there's no need to tag him.

---
If this reply helps you, Karma would be appreciated.

yvassilyeva
Path Finder

Thanks for the heads up!

0 Karma

Barty
Explorer

Perfect!! Thank you so much for this

richgalloway
SplunkTrust
SplunkTrust

The depends attribute tests for the presence of a token, not its value.  If you can get your tokens to be present only when the panel should be seen then you can use

 

<panel depends=$time_check1$>
...

 

---
If this reply helps you, Karma would be appreciated.
0 Karma

Barty
Explorer

Thank you for the response.

As mentioned, the search that builds the values runs on load and then identifies if it is prior to 1:30pm, or 4pm. I appreciate the depends element relies on the prescence of a token, I'm wondering if you can trigger the panel display based on the value of the token present??

0 Karma

richgalloway
SplunkTrust
SplunkTrust
As I said, the depends attribute tests for the presence of a token, not its value. You can use conditions, however, to test a token value and set a depends token. See https://docs.splunk.com/Documentation/Splunk/8.0.5/Viz/ContextualDrilldown#Configure_conditional_beh... .
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...