Splunk Search

Default value in Dashboard dynamic drop-down & hiding chart with depends

ppatkar
Path Finder

 

My Dashboard contains 4 inputs : 

Time , 2 Drop Downs ( One Static whose value changes Second Dynamic Drop Down query ) & lastly a free text input. I am trying to default by  Dynamic Drop Down to * (Shown as All to user) & free text input to *.

I need to show or hide the Stats header &  the Count chart based on whether user enters text in text input field. ( Hide Stats when value is not * ).  

I am having the below issues :

1. drop-down default value (*) in my Dynamic Drop Down is not appearing in my chart search .  selectFirstChoice field is appearing . However if I remove selectFirstChoice,  I see issues when I pick one value & then change stats drop down.

2. Chart gets hidden when I enter some text in text input , however when I remove the text , chart doesnt appear back unless I change the static drop down. 

Below is my Dashboard source :

<form>
  <label>My Dashboard</label>
  <fieldset autoRun="false" submitButton="true">
    <input type="time" token="timeInput">
      <label>Select a Time:</label>
      <default>
        <earliest>-7d@h</earliest>
        <latest>now</latest>
      </default>
    </input>
    <input type="dropdown" token="field1" searchWhenChanged="false">
      <label>Select Publisher/Subcriber:</label>
      <choice value="pub">Publisher</choice>
      <choice value="sub">Subscriber</choice>
      <selectFirstChoice>true</selectFirstChoice>
      <change>
        <condition match="match(value,&quot;sub&quot;)">
          <set token="ind">sub_core</set>
          <set token="intype">SubiName</set>
          <set token="infname">SubfName</set>
          <set token="infsize">SubfSize</set>
          <set token="hide_panel">true</set>
        </condition>
        <condition match="match(value,&quot;pub&quot;)">
          <set token="ind">pub_core</set>
          <set token="intype">PubiName</set>
          <set token="infname">PubfName</set>
          <set token="infsize">PubfSize</set>
          <set token="hide_panel">true</set>
        </condition>
      </change>
    </input>
    <input type="dropdown" token="field2">
      <label>Select Interface: (Optional)</label>
      <choice value="*">All</choice>
      <selectFirstChoice>true</selectFirstChoice>
      <fieldForLabel>interface</fieldForLabel>
      <fieldForValue>interface</fieldForValue>
      <search>
        <query>index=$ind$ service | rename $intype$ AS interface | stats count by interface</query>
        <earliest>-7d@h</earliest>
        <latest>now</latest>
        <preview>
          <condition>
            <set token="interface">$result.interface$</set>
            <set token="hide_panel">true</set>
          </condition>
        </preview>
      </search>
    </input>
    <input type="text" token="filename" searchWhenChanged="true">
      <label>Provide a filename: (Optional)</label>
      <default>*</default>
      <change>
        <condition match="len($filename$) > 1">
          <unset token="hide_panel"></unset>
        </condition>
      </change>
    </input>
  </fieldset>
  <row>
    <panel depends="$hide_panel$" id="title">
      <title>Stats</title>
    </panel>
  </row>
  <row>
    <panel>
      <chart depends="$hide_panel$">
        <title>File Count</title>
        <search>
          <query>index=$ind$ service $interface$ | dedup $infname$ | stats count($infsize$) by $intype$ | sort - count($infsize$) </query>
          <earliest>$timeInput.earliest$</earliest>
          <latest>$timeInput.latest$</latest>
        </search>
        <option name="charting.axisTitleY.visibility">collapsed</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.chart">column</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisEnd</option>
        <option name="charting.legend.placement">none</option>
        <option name="height">160</option>
        <option name="trellis.enabled">0</option>
      </chart>
    </panel>
  </row>
</form>

 

Any help here is appreciated. 

Labels (1)
Tags (1)
0 Karma

ppatkar
Path Finder

 

1. drop-down default value (*) in my Dynamic Drop Down is not appearing in my chart search .  selectFirstChoice field is appearing . However if I remove selectFirstChoice,  I see issues when I pick one value & then change stats drop down.

-- This is still an issue .

2. Chart gets hidden when I enter some text in text input , however when I remove the text , chart doesnt appear back unless I change the static drop down. 

-- This has been fixed with the below latest. 

<form>
  <label>My Dashboard</label>
  <fieldset autoRun="false" submitButton="true">
    <input type="time" token="timeInput">
      <label>Select a Time:</label>
      <default>
        <earliest>-7d@h</earliest>
        <latest>now</latest>
      </default>
    </input>
    <input type="dropdown" token="field1" searchWhenChanged="false">
      <label>Select Publisher/Subcriber:</label>
      <choice value="pub">Publisher</choice>
      <choice value="sub">Subscriber</choice>
      <selectFirstChoice>true</selectFirstChoice>
      <change>
        <condition match="match(value,&quot;sub&quot;)">
          <set token="ind">sub_core</set>
          <set token="intype">SubiName</set>
          <set token="infname">SubfName</set>
          <set token="infsize">SubfSize</set>
          <set token="hide_panel">true</set>
        </condition>
        <condition match="match(value,&quot;pub&quot;)">
          <set token="ind">pub_core</set>
          <set token="intype">PubiName</set>
          <set token="infname">PubfName</set>
          <set token="infsize">PubfSize</set>
          <set token="hide_panel">true</set>
        </condition>
      </change>
    </input>
    <input type="dropdown" token="interface">
      <label>Select Interface: (Optional)</label>
      <choice value="*">All</choice>
      <selectFirstChoice>true</selectFirstChoice>
      <fieldForLabel>interface</fieldForLabel>
      <fieldForValue>interface</fieldForValue>
      <search>
        <query>index=$ind$ service | rename $intype$ AS interface | stats count by interface</query>
        <earliest>-7d@h</earliest>
        <latest>now</latest>
        <preview>
          <condition>
            <set token="interface">$result.interface$</set>
            <set token="hide_panel">true</set>
          </condition>
        </preview>
      </search>
    </input>
    <input type="text" token="filename" searchWhenChanged="true">
      <label>Provide a filename: (Optional)</label>
      <default>*</default>
      <change>
        <condition match="len($filename$) > 1">
          <unset token="hide_panel"></unset>
          <set token="show_panel">true</set>
        </condition>
        <condition match="len($filename$) &lt; 2">
          <unset token="show_panel"></unset>
          <set token="hide_panel">true</set>
        </condition>
      </change>
    </input>
  </fieldset>
  <row>
    <panel depends="$hide_panel$" id="title">
      <title>Stats</title>
    </panel>
  </row>
  <row>
    <panel>
      <chart depends="$hide_panel$">
        <title>File Count</title>
        <search>
          <query>index=$ind$ service $interface$ | dedup $infname$ | stats count($infsize$) by $intype$ | sort - count($infsize$) </query>
          <earliest>$timeInput.earliest$</earliest>
          <latest>$timeInput.latest$</latest>
        </search>
        <option name="charting.axisTitleY.visibility">collapsed</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.chart">column</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisEnd</option>
        <option name="charting.legend.placement">none</option>
        <option name="height">160</option>
        <option name="trellis.enabled">0</option>
      </chart>
    </panel>
  </row>
</form>

 

 

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...