Dashboards & Visualizations

Use two depends in a dashboard panel

gcusello
SplunkTrust
SplunkTrust

Hi at all,
in a dashboard, I need the possibility to choose between two searches to display results in a panel and at the same time to display an html message if there's no result in each of them.
In other words, I'd like to use two depends from Splunk Dashboard Examples App in a panel: a "Link Switcher" and a "Null Search Swapper".
The "Link switcher" correctly runs but I always have the html message, in other words the "Null Search Swapper" doesn't run.

This is my code:

<form>
  <label>Home Page</label>
  <search id="search_1">
    <query>
      my_search1
    </query>
    <earliest>$Time.earliest$</earliest>
    <latest>$Time.latest$</latest>
    <progress>
      <condition match="$job.resultCount$ == 0">
        <set token="show_html1">Errors</set>
      </condition>
      <condition>
        <unset token="show_html1"></unset>
      </condition>
    </progress>
  </search>
  <search id="search_2">
    <query>
      my_search2
    </query>
    <earliest>$Time.earliest$</earliest>
    <latest>$Time.latest$</latest>
    <progress>
      <condition match="$job.resultCount$ == 0">
        <set token="show_html2">Errors</set>
      </condition>
      <condition>
        <unset token="show_html2"></unset>
      </condition>
    </progress>
  </search>
  <fieldset submitButton="false">
    <input type="time" token="Time">
      <label>Periodo</label>
      <default>
        <earliest>@d</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <input type="link" token="application">
        <label>Area Applicativa:</label>
        <choice value="One">One</choice>
        <choice value="Two">Two</choice>
        <default>One</default>
        <change>
          <condition value="One">
            <set token="showOne">true</set>
            <unset token="showTwo"></unset>
          </condition>
        <condition value="Two">
          <unset token="showOne"></unset>
            <set token="showTwo">true</set>
            </condition>
          </change>
        </input>
    </panel>
  </row>
  <row>
    <panel>
      <table depends="$showOne$" rejects="$show_html1$">
        <search base="search_1">
          <query>
            my_query
            </query>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
      <html depends="$show_html1$">
         <p style="color:green;margin-left:30px;font-size:30px">No Errors</p>
      </html>
      <table depends="$showTwo$" rejects="$show_html2$">
        <search base="search_2">
          <query>
            my_search
            </query>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
      <html depends="$show_html2$">
         <p style="color:green;margin-left:30px;font-size:30px">No Errors</p>
      </html>
    </panel>
  </row>
</form>

I don't understand if there's something wrong or if it's not possible to combine two depends.

Thank you in advance.
Bye.
Giuseppe

0 Karma
1 Solution

elliotproebstel
Champion

I'm trying to wrap my head about this, but I am not sure I get it. My best guess is that we need to separate the depends and rejects statements. Does it work if you replace the final <row> element with this:

   <row>
     <panel depends="$showOne$">
       <table rejects="$show_html1$">
         <search base="search_1">
           <query>
             my_query
             </query>
         </search>
         <option name="count">100</option>
         <option name="dataOverlayMode">none</option>
         <option name="drilldown">none</option>
         <option name="percentagesRow">false</option>
         <option name="rowNumbers">false</option>
         <option name="totalsRow">false</option>
         <option name="wrap">true</option>
       </table>
       <html depends="$show_html1$">
          <p style="color:green;margin-left:30px;font-size:30px">No Errors</p>
       </html>
     </panel>
     <panel depends="$showTwo$">
       <table rejects="$show_html2$">
         <search base="search_2">
           <query>
             my_search
             </query>
         </search>
         <option name="count">100</option>
         <option name="dataOverlayMode">none</option>
         <option name="drilldown">none</option>
         <option name="percentagesRow">false</option>
         <option name="rowNumbers">false</option>
         <option name="totalsRow">false</option>
         <option name="wrap">true</option>
       </table>
       <html depends="$show_html2$">
          <p style="color:green;margin-left:30px;font-size:30px">No Errors</p>
       </html>
     </panel>
   </row>

View solution in original post

0 Karma

elliotproebstel
Champion

I'm trying to wrap my head about this, but I am not sure I get it. My best guess is that we need to separate the depends and rejects statements. Does it work if you replace the final <row> element with this:

   <row>
     <panel depends="$showOne$">
       <table rejects="$show_html1$">
         <search base="search_1">
           <query>
             my_query
             </query>
         </search>
         <option name="count">100</option>
         <option name="dataOverlayMode">none</option>
         <option name="drilldown">none</option>
         <option name="percentagesRow">false</option>
         <option name="rowNumbers">false</option>
         <option name="totalsRow">false</option>
         <option name="wrap">true</option>
       </table>
       <html depends="$show_html1$">
          <p style="color:green;margin-left:30px;font-size:30px">No Errors</p>
       </html>
     </panel>
     <panel depends="$showTwo$">
       <table rejects="$show_html2$">
         <search base="search_2">
           <query>
             my_search
             </query>
         </search>
         <option name="count">100</option>
         <option name="dataOverlayMode">none</option>
         <option name="drilldown">none</option>
         <option name="percentagesRow">false</option>
         <option name="rowNumbers">false</option>
         <option name="totalsRow">false</option>
         <option name="wrap">true</option>
       </table>
       <html depends="$show_html2$">
          <p style="color:green;margin-left:30px;font-size:30px">No Errors</p>
       </html>
     </panel>
   </row>
0 Karma

gcusello
SplunkTrust
SplunkTrust

It works!
Thank you very much.
Bye.
Giuseppe

0 Karma

elliotproebstel
Champion

Great!! I'm glad we got it sorted.

0 Karma

elliotproebstel
Champion

I'm pretty confused by these two lines:

<table depends="$showOne$" rejects="$show_html1$">
<table depends="$showTwo$" rejects="$show_html2$">

What should happen if $showOne$ and $show_html1$ are both defined/set? Should it display or not? Likewise for the Two/2 line - what happens if both are defined/set?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Probably this is the problem:
I have two conditions: one guided by Link Switcher and one guided by Null Swapper.
these are the eight situations:

  • $showOne$==true and $show_html1$==true and $show_html2$==true this means that I want display data1 and I haven't both data1 and data2 to display in this case I have two messages NO CORRECT
  • $showOne$==true and $show_html1$==true and $show_html2$==false this means that I want display data1 and I haven't data1 and I have data2 to display in this case I have one message CORRECT
  • $showTwo$==true and $show_html1$==true and $show_html2$==true this means that I want display data2 and I haven't both data1 and data2 to display in this case I have two messages NO CORRECT
  • $showTwo$==true and $show_html1$==true and $show_html2$==false this means that I want display data2 and I haven't data1 and I have data2 to display in this case I have a chart and one message NO CORRECT
  • $showOne$==true and $show_html1$==false and $show_html2$==true this means that I want display data1 and I have data1 and I haven't data2 to display in this case I have a chart and one message CORRECT
  • $showOne$==true and $show_html1$==false and $show_html2$==false this means that I want display data1 and I have data1 and I have data2 to display in this case I haven't messages CORRECT
  • $showTwo$==true and $show_html1$==false and $show_html2$==true this means that I want display data2 and I have data1 and I haven't data2 to display in this case I have a chart and one message NO CORRECT
  • $showTwo$==true and $show_html1$==false and $show_html2$==false this means that I want display data1 and I have data1 and I have data2 to display in this case I haven't messages CORRECT

where:

  • $showOne$ is a chart with the same data of $show_html1$
  • $showTwo$ is a chart with the same data of $show_html2$

In few words, I have problems when:

  • $show_html1$ and $show_html2$ are both true because I have two messages;
  • one of them is true and the other is false and I want to display in a chart data of the other search.

I hope to be clear, the problem is to manage two switchers at the same time!

Bye.
Giuseppe

0 Karma

shandr
Path Finder

I have used below syntax so a panel will stay hidden until 2 or more conditions have been met. Hopefully helps.

<panel depends="$isLinux$$isHealthy$">

That panel only shows when both tokens have a <set> value. If any token is <unset> then that panel is hidden.

0 Karma
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...