Splunk Search

When viewing a dashboard, how to control what panels run?

HattrickNZ
Motivator

I have the below very simple dashboard for illustration. (assume a chart would be in row 2 and row 3)
My question is, do panels in row 2 and row 3 run when I visit the dashboard? What I mean is, if there was a chart in row 2 and row 3, do the charts get built when I visit the dashboard, thereby on ticking the selectbox will open the charts that are already running?

Or does the search for the charts in row 2 and 3 not run until the selectbox is ticked after visiting the dashboard? This is what I would like to achieve.

  <form>
    <label>shoing and hiding rows Clone</label>
    <description>showing and hiding rows description https://answers.splunk.com/answers/298909/is-there-a-tagname-i-can-use-in-simple-xml-that-i.html</de...;
    <row>
        <panel>
            <html>
                 <h1>this is a h1</h1>


            </html>
        </panel>
    </row>
    <row>
        <panel>
            <input type="checkbox" token="show_token" searchWhenChanged="true">
            <choice value="show">show rows 2 and 3</choice>
            </input>
        </panel>
    </row>
    <row depends="$show_token$">
        <panel>
            <html>
                 <h2>this is a h2 </h2>


            </html>
        </panel>
    </row>
    <row depends="$show_token$">
        <panel>
            <html>
                 <h3>this is a h3 </h3>


            </html>
        </panel>
    </row>
</form>

Maybe I have to use fieldset to offer more control?

<fieldset autoRun="true" submitButton="true">
    <input type="checkbox" token="show_token" searchWhenChanged="true">
    <choice value="show">show rows 2 and 3</choice>
    </input>
</fieldset>

NOTE similar/related question here

somesoni2
Revered Legend

The depends option only control the visibility of the panel. The panel will still run at dashboard load, depending upon the search (if it needs any token to be set it, then will not run till that time).

If you want to have your panel searches run only after that token /checkbox is selected, then you need to include that token (which you used in depends) to your search as well so that the search will run until that token is set.

You can set the token value of $show_token$ to something which will always be true/satisfied in the search string, e.g. 1=1

 <input type="checkbox" token="show_token" searchWhenChanged="true">
             <choice value="1=1">show rows 2 and 3</choice>
             </input>

anantdeshpande
Path Finder

Hi,
Can you explain me little bit more on using value="1=1"? My code looks like below.

<form>
  <label>Transaction Search</label>
  <fieldset autoRun="false" submitButton="true">
    <input type="dropdown" token="Tran_Type">
      <label>TRANSACTION TYPE</label>
      <choice value="inward">INWARD</choice>
      <choice value="outward">OUTWARD</choice>
      <default>outward</default>
      <change>
        <condition value="outward">
          <set token="out">*</set>
          <unset token="income"></unset>
        </condition>
        <condition value="inward">
          <set token="income">*</set>
          <unset token="out"></unset>
        </condition>
      </change>
    </fieldset>
   <row>
    <panel depends="$out$">
      <table>
        <search>
          <query>index=idx_#####_db ------------------------- </query>
      </table>
    </panel>
    <panel depends="$income$">
      <table>
        <search>
          <query>index=idx_#####_log ------------------------- </query>
      </table>
    </panel>
  </row>
</form>
0 Karma

HattrickNZ
Motivator

Fixed your code for you. Or it works at least. THe submit is redundant or does not work. Hope it may help!

<form>
   <label>Transaction Search</label>
   <fieldset autoRun="false" submitButton="true">
     <input type="dropdown" token="Tran_Type">
       <label>TRANSACTION TYPE</label>
       <choice value="inward">INWARD</choice>
       <choice value="outward">OUTWARD</choice>
       <default>outward</default>

      <change>
         <condition value="outward">
           <set token="out">*</set>
           <unset token="income"></unset>
         </condition>
         <condition value="inward">
           <set token="income">*</set>
           <unset token="out"></unset>
         </condition>
      </change>

       </input>

     </fieldset>
    <row>
     <panel depends="$out$">
       <html>
       <h1> test OUTWARD</h1>
       </html>
     </panel>
     <panel depends="$income$">
       <html>
       <h1> test INWARD</h1>
       </html>
     </panel>
   </row>
 </form>
0 Karma

sundareshr
Legend

If you move the depends=$show_true$ to the <panel> tag, the two panels will not show till the token show_token is set. In your example, that will happen only when user clicks on the checkbox. So when the dashboards loads, the panels will not be visible.

HattrickNZ
Motivator

this is slightly related and may be useful http://i-splunk.blogspot.co.nz/2014/03/toggle-splunk-panels.html - has more to do with panels in html

0 Karma

smudge797
Path Finder

link not working.

0 Karma

HattrickNZ
Motivator

link works for me now.

0 Karma
Get Updates on the Splunk Community!

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...