Splunk Search

Default value in Dashboard dynamic drop-down & hiding chart with depends

ppatkar
Path Finder

 

My Dashboard contains 4 inputs : 

Time , 2 Drop Downs ( One Static whose value changes Second Dynamic Drop Down query ) & lastly a free text input. I am trying to default by  Dynamic Drop Down to * (Shown as All to user) & free text input to *.

I need to show or hide the Stats header &  the Count chart based on whether user enters text in text input field. ( Hide Stats when value is not * ).  

I am having the below issues :

1. drop-down default value (*) in my Dynamic Drop Down is not appearing in my chart search .  selectFirstChoice field is appearing . However if I remove selectFirstChoice,  I see issues when I pick one value & then change stats drop down.

2. Chart gets hidden when I enter some text in text input , however when I remove the text , chart doesnt appear back unless I change the static drop down. 

Below is my Dashboard source :

<form>
  <label>My Dashboard</label>
  <fieldset autoRun="false" submitButton="true">
    <input type="time" token="timeInput">
      <label>Select a Time:</label>
      <default>
        <earliest>-7d@h</earliest>
        <latest>now</latest>
      </default>
    </input>
    <input type="dropdown" token="field1" searchWhenChanged="false">
      <label>Select Publisher/Subcriber:</label>
      <choice value="pub">Publisher</choice>
      <choice value="sub">Subscriber</choice>
      <selectFirstChoice>true</selectFirstChoice>
      <change>
        <condition match="match(value,&quot;sub&quot;)">
          <set token="ind">sub_core</set>
          <set token="intype">SubiName</set>
          <set token="infname">SubfName</set>
          <set token="infsize">SubfSize</set>
          <set token="hide_panel">true</set>
        </condition>
        <condition match="match(value,&quot;pub&quot;)">
          <set token="ind">pub_core</set>
          <set token="intype">PubiName</set>
          <set token="infname">PubfName</set>
          <set token="infsize">PubfSize</set>
          <set token="hide_panel">true</set>
        </condition>
      </change>
    </input>
    <input type="dropdown" token="field2">
      <label>Select Interface: (Optional)</label>
      <choice value="*">All</choice>
      <selectFirstChoice>true</selectFirstChoice>
      <fieldForLabel>interface</fieldForLabel>
      <fieldForValue>interface</fieldForValue>
      <search>
        <query>index=$ind$ service | rename $intype$ AS interface | stats count by interface</query>
        <earliest>-7d@h</earliest>
        <latest>now</latest>
        <preview>
          <condition>
            <set token="interface">$result.interface$</set>
            <set token="hide_panel">true</set>
          </condition>
        </preview>
      </search>
    </input>
    <input type="text" token="filename" searchWhenChanged="true">
      <label>Provide a filename: (Optional)</label>
      <default>*</default>
      <change>
        <condition match="len($filename$) > 1">
          <unset token="hide_panel"></unset>
        </condition>
      </change>
    </input>
  </fieldset>
  <row>
    <panel depends="$hide_panel$" id="title">
      <title>Stats</title>
    </panel>
  </row>
  <row>
    <panel>
      <chart depends="$hide_panel$">
        <title>File Count</title>
        <search>
          <query>index=$ind$ service $interface$ | dedup $infname$ | stats count($infsize$) by $intype$ | sort - count($infsize$) </query>
          <earliest>$timeInput.earliest$</earliest>
          <latest>$timeInput.latest$</latest>
        </search>
        <option name="charting.axisTitleY.visibility">collapsed</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.chart">column</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisEnd</option>
        <option name="charting.legend.placement">none</option>
        <option name="height">160</option>
        <option name="trellis.enabled">0</option>
      </chart>
    </panel>
  </row>
</form>

 

Any help here is appreciated. 

Labels (2)
Tags (1)
0 Karma

ppatkar
Path Finder

 

1. drop-down default value (*) in my Dynamic Drop Down is not appearing in my chart search .  selectFirstChoice field is appearing . However if I remove selectFirstChoice,  I see issues when I pick one value & then change stats drop down.

-- This is still an issue .

2. Chart gets hidden when I enter some text in text input , however when I remove the text , chart doesnt appear back unless I change the static drop down. 

-- This has been fixed with the below latest. 

<form>
  <label>My Dashboard</label>
  <fieldset autoRun="false" submitButton="true">
    <input type="time" token="timeInput">
      <label>Select a Time:</label>
      <default>
        <earliest>-7d@h</earliest>
        <latest>now</latest>
      </default>
    </input>
    <input type="dropdown" token="field1" searchWhenChanged="false">
      <label>Select Publisher/Subcriber:</label>
      <choice value="pub">Publisher</choice>
      <choice value="sub">Subscriber</choice>
      <selectFirstChoice>true</selectFirstChoice>
      <change>
        <condition match="match(value,&quot;sub&quot;)">
          <set token="ind">sub_core</set>
          <set token="intype">SubiName</set>
          <set token="infname">SubfName</set>
          <set token="infsize">SubfSize</set>
          <set token="hide_panel">true</set>
        </condition>
        <condition match="match(value,&quot;pub&quot;)">
          <set token="ind">pub_core</set>
          <set token="intype">PubiName</set>
          <set token="infname">PubfName</set>
          <set token="infsize">PubfSize</set>
          <set token="hide_panel">true</set>
        </condition>
      </change>
    </input>
    <input type="dropdown" token="interface">
      <label>Select Interface: (Optional)</label>
      <choice value="*">All</choice>
      <selectFirstChoice>true</selectFirstChoice>
      <fieldForLabel>interface</fieldForLabel>
      <fieldForValue>interface</fieldForValue>
      <search>
        <query>index=$ind$ service | rename $intype$ AS interface | stats count by interface</query>
        <earliest>-7d@h</earliest>
        <latest>now</latest>
        <preview>
          <condition>
            <set token="interface">$result.interface$</set>
            <set token="hide_panel">true</set>
          </condition>
        </preview>
      </search>
    </input>
    <input type="text" token="filename" searchWhenChanged="true">
      <label>Provide a filename: (Optional)</label>
      <default>*</default>
      <change>
        <condition match="len($filename$) > 1">
          <unset token="hide_panel"></unset>
          <set token="show_panel">true</set>
        </condition>
        <condition match="len($filename$) &lt; 2">
          <unset token="show_panel"></unset>
          <set token="hide_panel">true</set>
        </condition>
      </change>
    </input>
  </fieldset>
  <row>
    <panel depends="$hide_panel$" id="title">
      <title>Stats</title>
    </panel>
  </row>
  <row>
    <panel>
      <chart depends="$hide_panel$">
        <title>File Count</title>
        <search>
          <query>index=$ind$ service $interface$ | dedup $infname$ | stats count($infsize$) by $intype$ | sort - count($infsize$) </query>
          <earliest>$timeInput.earliest$</earliest>
          <latest>$timeInput.latest$</latest>
        </search>
        <option name="charting.axisTitleY.visibility">collapsed</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.chart">column</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisEnd</option>
        <option name="charting.legend.placement">none</option>
        <option name="height">160</option>
        <option name="trellis.enabled">0</option>
      </chart>
    </panel>
  </row>
</form>

 

 

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...