Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Dashboards & Visualizations
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Find Answers
- :
- Using Splunk
- :
- Dashboards & Visualizations
- :
- Use two depends in a dashboard panel
Options
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
gcusello
SplunkTrust
03-08-2018
01:07 AM
Hi at all,
in a dashboard, I need the possibility to choose between two searches to display results in a panel and at the same time to display an html message if there's no result in each of them.
In other words, I'd like to use two depends from Splunk Dashboard Examples App in a panel: a "Link Switcher" and a "Null Search Swapper".
The "Link switcher" correctly runs but I always have the html message, in other words the "Null Search Swapper" doesn't run.
This is my code:
<form>
<label>Home Page</label>
<search id="search_1">
<query>
my_search1
</query>
<earliest>$Time.earliest$</earliest>
<latest>$Time.latest$</latest>
<progress>
<condition match="$job.resultCount$ == 0">
<set token="show_html1">Errors</set>
</condition>
<condition>
<unset token="show_html1"></unset>
</condition>
</progress>
</search>
<search id="search_2">
<query>
my_search2
</query>
<earliest>$Time.earliest$</earliest>
<latest>$Time.latest$</latest>
<progress>
<condition match="$job.resultCount$ == 0">
<set token="show_html2">Errors</set>
</condition>
<condition>
<unset token="show_html2"></unset>
</condition>
</progress>
</search>
<fieldset submitButton="false">
<input type="time" token="Time">
<label>Periodo</label>
<default>
<earliest>@d</earliest>
<latest>now</latest>
</default>
</input>
</fieldset>
<row>
<panel>
<input type="link" token="application">
<label>Area Applicativa:</label>
<choice value="One">One</choice>
<choice value="Two">Two</choice>
<default>One</default>
<change>
<condition value="One">
<set token="showOne">true</set>
<unset token="showTwo"></unset>
</condition>
<condition value="Two">
<unset token="showOne"></unset>
<set token="showTwo">true</set>
</condition>
</change>
</input>
</panel>
</row>
<row>
<panel>
<table depends="$showOne$" rejects="$show_html1$">
<search base="search_1">
<query>
my_query
</query>
</search>
<option name="count">100</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>
<html depends="$show_html1$">
<p style="color:green;margin-left:30px;font-size:30px">No Errors</p>
</html>
<table depends="$showTwo$" rejects="$show_html2$">
<search base="search_2">
<query>
my_search
</query>
</search>
<option name="count">100</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>
<html depends="$show_html2$">
<p style="color:green;margin-left:30px;font-size:30px">No Errors</p>
</html>
</panel>
</row>
</form>
I don't understand if there's something wrong or if it's not possible to combine two depends.
Thank you in advance.
Bye.
Giuseppe
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
elliotproebstel
Champion
03-08-2018
11:19 AM
I'm trying to wrap my head about this, but I am not sure I get it. My best guess is that we need to separate the depends and rejects statements. Does it work if you replace the final <row> element with this:
<row>
<panel depends="$showOne$">
<table rejects="$show_html1$">
<search base="search_1">
<query>
my_query
</query>
</search>
<option name="count">100</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>
<html depends="$show_html1$">
<p style="color:green;margin-left:30px;font-size:30px">No Errors</p>
</html>
</panel>
<panel depends="$showTwo$">
<table rejects="$show_html2$">
<search base="search_2">
<query>
my_search
</query>
</search>
<option name="count">100</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>
<html depends="$show_html2$">
<p style="color:green;margin-left:30px;font-size:30px">No Errors</p>
</html>
</panel>
</row>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
elliotproebstel
Champion
03-08-2018
11:19 AM
I'm trying to wrap my head about this, but I am not sure I get it. My best guess is that we need to separate the depends and rejects statements. Does it work if you replace the final <row> element with this:
<row>
<panel depends="$showOne$">
<table rejects="$show_html1$">
<search base="search_1">
<query>
my_query
</query>
</search>
<option name="count">100</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>
<html depends="$show_html1$">
<p style="color:green;margin-left:30px;font-size:30px">No Errors</p>
</html>
</panel>
<panel depends="$showTwo$">
<table rejects="$show_html2$">
<search base="search_2">
<query>
my_search
</query>
</search>
<option name="count">100</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>
<html depends="$show_html2$">
<p style="color:green;margin-left:30px;font-size:30px">No Errors</p>
</html>
</panel>
</row>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
gcusello
SplunkTrust
03-09-2018
08:33 AM
It works!
Thank you very much.
Bye.
Giuseppe
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
elliotproebstel
Champion
03-09-2018
08:45 AM
Great!! I'm glad we got it sorted.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
elliotproebstel
Champion
03-08-2018
08:00 AM
I'm pretty confused by these two lines:
<table depends="$showOne$" rejects="$show_html1$">
<table depends="$showTwo$" rejects="$show_html2$">
What should happen if $showOne$ and $show_html1$ are both defined/set? Should it display or not? Likewise for the Two/2 line - what happens if both are defined/set?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
gcusello
SplunkTrust
03-08-2018
08:33 AM
Probably this is the problem:
I have two conditions: one guided by Link Switcher and one guided by Null Swapper.
these are the eight situations:
- $showOne$==true and $show_html1$==true and $show_html2$==true this means that I want display data1 and I haven't both data1 and data2 to display in this case I have two messages NO CORRECT
- $showOne$==true and $show_html1$==true and $show_html2$==false this means that I want display data1 and I haven't data1 and I have data2 to display in this case I have one message CORRECT
- $showTwo$==true and $show_html1$==true and $show_html2$==true this means that I want display data2 and I haven't both data1 and data2 to display in this case I have two messages NO CORRECT
- $showTwo$==true and $show_html1$==true and $show_html2$==false this means that I want display data2 and I haven't data1 and I have data2 to display in this case I have a chart and one message NO CORRECT
- $showOne$==true and $show_html1$==false and $show_html2$==true this means that I want display data1 and I have data1 and I haven't data2 to display in this case I have a chart and one message CORRECT
- $showOne$==true and $show_html1$==false and $show_html2$==false this means that I want display data1 and I have data1 and I have data2 to display in this case I haven't messages CORRECT
- $showTwo$==true and $show_html1$==false and $show_html2$==true this means that I want display data2 and I have data1 and I haven't data2 to display in this case I have a chart and one message NO CORRECT
- $showTwo$==true and $show_html1$==false and $show_html2$==false this means that I want display data1 and I have data1 and I have data2 to display in this case I haven't messages CORRECT
where:
- $showOne$ is a chart with the same data of $show_html1$
- $showTwo$ is a chart with the same data of $show_html2$
In few words, I have problems when:
- $show_html1$ and $show_html2$ are both true because I have two messages;
- one of them is true and the other is false and I want to display in a chart data of the other search.
I hope to be clear, the problem is to manage two switchers at the same time!
Bye.
Giuseppe
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
shandr
Path Finder
08-18-2021
07:55 PM
I have used below syntax so a panel will stay hidden until 2 or more conditions have been met. Hopefully helps.
<panel depends="$isLinux$$isHealthy$">
That panel only shows when both tokens have a <set> value. If any token is <unset> then that panel is hidden.
Get Updates on the Splunk Community!
Enterprise Security Content Update (ESCU) | New Releases
In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...
Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?
(This is the first of a series of 2 blogs).
Splunk Enterprise Security is a fantastic tool that offers robust ...
Index This | What are the 12 Days of Splunk-mas?
December 2024 Edition
Hayyy Splunk Education Enthusiasts and the Eternally Curious!
We’re back with another ...
