Dashboards & Visualizations

How to set loading order for panels?

zeinstein
Path Finder

Hi,

I have a dashboard with 10+ panels and want to set an order for them in which they are loaded. This way I could make sure that the most important panels get loaded first and then the others.
Do you know a way to do it? (JS is fine, too. I just need a cornerstone for it.)
I'm interested in solutions for Splunk Enterprise 6.3 and 6.5 also.

Thanks!

1 Solution

woodcock
Esteemed Legend

This is based off of this Q&A:
https://answers.splunk.com/answers/511694/i-have-6-panels-on-a-dashboard-but-can-only-run-3.html#ans...

Yes, you can do this in Simple XML.

Add this to the search of the panel that is to load second

| $NOOP_1$

And this to the search of the panel that is to load third, and so on:

| $NOOP_2$

Then you go to the panel that is to load first and make it look like this:

<panel>
  <title>Your First Panel</title>
  <chart>
    <search>
      <query>Your First Panel Search Here</query>
      <earliest>Your Earliest Here</earliest>
      <latest>Your Latest Here</latest>
      <progress>
         <unset token="NOOP_1"></unset>
      </progress>
      <done>
         <set token="NOOP_1">noop</set>
      </done>
    </search>
  </chart>
</panel>

Do your other panels the same way, each using a higher NOOP_# value that represents the show/search/load order.
You can even make the panels invisible until each starts loading by adding a depends.

View solution in original post

cmerriman
Super Champion

Try to go about it like this:

    <form>
      <init>
        <unset token="token1"></unset>
        <unset token="token2"></unset>
        <unset token="token3"></unset>
    .....
    </init>
    .....
    <input type="radio" token="panel">
          <label>Run Panels</label>
          <choice value="value1">label 1</choice>
          <choice value="value2">label 2</choice>
          <choice value="value3">label 3</choice>
    .....
    <change>
            <condition value="value1">
              <set token="token1">&#32;</set>
            </condition>
            <condition value="value2">
              <set token="token2">&#32;</set>
            </condition>
            <condition value="value3">
              <set token="token3">&#32;</set>
            </condition>
    .....
    </change>
        </input>
    .....
<table>
<search>
<query>$token1$.....

So this initials unsets the tokens for each panel. you'll have a radio button for each panel and when it is selected, that panel will run based on the token you place at the beginning of the query. another method of this would be to set and unset each token in each condition statement, that would make it so when you click on another input, the current input is unset and will no longer run. you can also use depends=$token1$ in the panel to only show the panels running/ran.

0 Karma

woodcock
Esteemed Legend

This is based off of this Q&A:
https://answers.splunk.com/answers/511694/i-have-6-panels-on-a-dashboard-but-can-only-run-3.html#ans...

Yes, you can do this in Simple XML.

Add this to the search of the panel that is to load second

| $NOOP_1$

And this to the search of the panel that is to load third, and so on:

| $NOOP_2$

Then you go to the panel that is to load first and make it look like this:

<panel>
  <title>Your First Panel</title>
  <chart>
    <search>
      <query>Your First Panel Search Here</query>
      <earliest>Your Earliest Here</earliest>
      <latest>Your Latest Here</latest>
      <progress>
         <unset token="NOOP_1"></unset>
      </progress>
      <done>
         <set token="NOOP_1">noop</set>
      </done>
    </search>
  </chart>
</panel>

Do your other panels the same way, each using a higher NOOP_# value that represents the show/search/load order.
You can even make the panels invisible until each starts loading by adding a depends.

ahmedn_splunk
Splunk Employee
Splunk Employee

Hi, reference to the above, when I tried adding | $NOOP_1$ to the saved search it gave me error:
Error in 'SearchParser': Missing a search command before '$'. Error at position '39' of search query 'search index=_internal | stats count | $NOOP_1$'

Any idea how to solve this?

0 Karma

woodcock
Esteemed Legend

You cannot add it to the saved search. It has to be in the dashaboard XML.

0 Karma

woodcock
Esteemed Legend

You should be able to use |savedsearch Your:search:details | $NOOP_1$ in your XML.

0 Karma

ahmedn_splunk
Splunk Employee
Splunk Employee

Thanks will try this...

0 Karma

zeinstein
Path Finder

Nice solution, thank you!
Only comment: for 6.5.x we should use done instead of finalized (I just read this in a comment at the link you've posted here).

rjthibod
Champion

@woodcock, you also have a syntax error in you unset line where the incorrect closing tag is used. I suggest the following change per @zeinstein comment.

           <progress>
              <unset token="NOOP_1"/>
           </progress>
           <done>
              <set token="NOOP_1">noop</set>
           </done>

woodcock
Esteemed Legend

I fixed it in the original solution; thank you.

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Very clever

0 Karma

kmaron
Motivator

There's a really nice answer in a different question about dashboards that might help:

https://answers.splunk.com/answers/511694/i-have-6-panels-on-a-dashboard-but-can-only-run-3.html

gcusello
Legend

Hi zeinstein,
Splunk doesn't have a method to give a load order for panels.
If you have the same search (or a similar one) in more panels, you could use the "post process search" method building a base search and use it for more panels.
See in the Splunk 6.x Dashboard Examples App (https://splunkbase.splunk.com/app/1603/) how to build it.
Bye.
Giuseppe

0 Karma

zeinstein
Path Finder

Hi Giuseppe,

That's what I was afraid of. Not even with js?

Thanks though!
Zeinstein

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

kmaron's link provides a useful method in an answer by woodcock.

Basically, you make the less-important searches wait for a value that hasn't been set yet, but that will be set to "noop" so it has no actual effect on the function.

You could also use "depends" to make the panels disappear until they are being populated.

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...