Splunk Search

How to change Inline Search based on the click.value in Simple XML?

theouhuios
Motivator

Hello

I am trying to implement an inline chart whose search criteria will change based on the $click.value$ on the table.

Example:

Table

Column-A   Column-B
ABC          456456
NBH          5635635

Drilldown will be based on the value of $row.Column-A$

Now the inline search should change based on whether the value selected is ABC or NBC

IF $row.Column-A$=ABC

<chart>
index=blah sourcetype=blah ...|timechart
</chart>


 IF $row.Column-A$=NBC 

   <chart>
    index=blah2 sourcetype=blah2 ...|timechart
    </chart>

Is it possible to toggle the depend field like this? Any Ideas?

0 Karma

gyslainlatsa
Motivator

hi theouhuios,
try like this and let me know if this solves your problem

<form>
  <label>In-Page Drilldown</label>
  <description/>
  <fieldset submitButton="false">
    <!--
            Create an input to store the drilldown value. It will be hidden using custom javascript when
            the dashboard is loaded.
         -->

    <input type="text" token="Column_A" searchWhenChanged="true"/>
  </fieldset>

  <row>
    <table id="master">
      <title>Display </title>
      <searchString>index=index_name sourcetype=sourcetype_file |table Column_A  Column_B</searchString>
      <!-- Set the type of of drilldown, since we will always consume the same field, use row-->
      <option name="drilldown">row</option>
      <drilldown>
        <!-- Use set to specify the new token to be created.
                     Use any token from the page or from the click event to produce the value needed. -->
        <set token="Column_A ">$row.Column_A$</set>
        <!-- If we also set the form.sourcetype the input will get updated too -->
        <set token="form.Column_A ">$row.Column_A$</set>
      </drilldown>
    </table>
  </row>

  <row>

   <panel id="detail" depends="$Column_A$">
     <title>Column_A=$Column_A$ </title>

     <input type="dropdown" token="newstatus" searchWhenChanged="true">
        <label>Change the value of Column_A</label>
        <choice value="ABC">ABC</choice>
        <choice value="NBH">NBH</choice>
        <default></default>

        <change>
          <condition value="ABC">
            <set token="new_search">index=index_name sourcetype=sourcetype_file  Column_A=$Column_A$ |timechart count </set>
          </condition>

          <condition value="NBH">
            <set token="new_search">index=index_name sourcetype=sourcetype_file  Column_A=$Column_A$ |timechart count by Column_B</set>
          </condition>
        </change>
  </input>

      <chart>
        <title>change the chart depending on the value of Column_A</title>
        <search>
          <query>$new_search$</query>
        </search>
      </chart>

   </panel>

  </row>
</form>
0 Karma

hiteshkanchan
Communicator

I tried using the same but when I use "change" and "condition" it is not able to get the query and i get the message as "No search query Provided". Any idea if it is version issue or something else. I am currently using 6.1.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...