Splunk Search

Hide Panel Not Working Version 6.5

g038123
Explorer

Hello,
Hoping for some help with this. We have a Dashboard that was working, at least that's what I was told, one of the panels was hidden until a state was clicked on the map. Now, when a state is clicked, the panel isn't displayed. I know the search is running because when I click on "Edit", I see the report/panel with correct results. The xml is below, can someone help point me in the right direction with what's not working here? Thanks in advance!

<panel>
      <title>Consult Communicator Location Map</title>
      <map>
        <title>Click on a State to see Location Details</title>
        <search>
          <query>| dbxquery query="Select MODEL,SERIAL,NAME,STREET_ADDR,CITY,STATE,POSTAL_CODE,OLSON_CODE FROM foo" connection="FOO_STDBY" shortnames=t  
| search CITY!="SMALL_TOWN" 
| lookup geo_attr_us_states state_code AS STATE OUTPUT state_name AS STATE
| stats count by STATE | geom geo_us_states featureIdField="STATE"</query>
          <earliest>@d</earliest>
          <latest>now</latest>
        </search>
        <!-- choropleth layer -->
        <!-- configure custom tile layer -->
        <option name="drilldown">all</option>
        <option name="mapping.choroplethLayer.colorBins">5</option>
        <option name="mapping.choroplethLayer.colorMode">categorical</option>
        <option name="mapping.choroplethLayer.maximumColor">0xAF1D12</option>
        <option name="mapping.choroplethLayer.minimumColor">0xEF6B62</option>
        <option name="mapping.choroplethLayer.shapeOpacity">0.6</option>
        <option name="mapping.choroplethLayer.showBorder">0</option>
        <option name="mapping.data.maxClusters">100</option>
        <option name="mapping.map.center">(45,-100)</option>
        <option name="mapping.map.panning">1</option>
        <option name="mapping.map.scrollZoom">0</option>
        <option name="mapping.map.zoom">3</option>
        <option name="mapping.markerLayer.markerMaxSize">50</option>
        <option name="mapping.markerLayer.markerMinSize">10</option>
        <option name="mapping.markerLayer.markerOpacity">0.8</option>
        <option name="mapping.showTiles">1</option>
        <option name="mapping.tileLayer.attribution">&amp;copy; <a
          href="http://www.openstreetmap.org/copyright">OpenStreetMap</a> contributors, &amp;copy;
          <a href="http://cartodb.com/attributions">CartoDB</a></option>
        <option name="mapping.tileLayer.maxZoom">18</option>
        <option name="mapping.tileLayer.minZoom">0</option>
        <option name="mapping.tileLayer.url">http://{s}.basemaps.cartocdn.com/dark_all/{z}/{x}/{y}.png</option>
        <option name="mapping.type">choropleth</option>
        <option name="link.openSearch.visible">false</option>
        <option name="link.openPivot.visible">false</option>
        <option name="link.inspectSearch.visible">false</option>
        <option name="link.exportResults.visible">true</option>
        <drilldown>
          <set token="src_type_tok">$click.value$</set>
        </drilldown>
      </map>
    </panel>
    <panel depends="$panel_show$">
      <table>
        <title>State Details</title>
        <search>
          <query>| dbxquery query="Select MODEL,SERIAL,NAME,STREET_ADDR,CITY,STATE,POSTAL_CODE,OLSON_CODE FROM lwpoc" connection="FOO_STDBY" shortnames=t   | search CITY!="SMALL TOWN"  | lookup geo_attr_us_states state_code AS STATE OUTPUT state_name AS STATE | search STATE=$src_type_tok$ | fields - _raw - _time</query>
          <earliest>0</earliest>
          <latest></latest>
        </search>
        <option name="count">15</option>
      </table>
    </panel>
  </row>
Tags (1)
0 Karma
1 Solution

cmerriman
Super Champion

instead of having it set to <panel depends="$panel_show$"> try setting it to <panel depends="$src_type_tok$">

that token is what you're using to set the state, so theoretically, it is the token that the depends could be set on to show the panel for the drilldown.

View solution in original post

cmerriman
Super Champion

instead of having it set to <panel depends="$panel_show$"> try setting it to <panel depends="$src_type_tok$">

that token is what you're using to set the state, so theoretically, it is the token that the depends could be set on to show the panel for the drilldown.

g038123
Explorer

Thank you for the reply!
I did set ** as I was troubleshooting this dashboard.
Sadly, the panel remains visible.
I'm taking over the Splunk responsibilities from someone who left the company, so I'm new to this, from what I've read the depends should hide the panel. Am I off base on that?

0 Karma

g038123
Explorer

Sorry, this got cut off.
I did set <panel depends="$src_type_tok$">

0 Karma

cmerriman
Super Champion

try to use <set token="src_type_tok">$click.value2$</set>
depends should hide the panel until the src_type_tok is set, ie: the value is clicked on. try to add in <form script="showtokens.js"> at the top of your xml as a token debugger to make sure the tokens are setting correctly.

0 Karma

g038123
Explorer

Awesome!
That worked perfectly.

Thank you to everyone who responded, much appreciated!

0 Karma

woodcock
Esteemed Legend

Your problem is the panel_show token which is never set anywhere. You either need to change that line to just <panel> (and it will always show) or set that token somewhere (perhaps in a done clause of as the result of a click or drilldown or something).

woodcock
Esteemed Legend

You also should unset the token when the form is reinitialized.

0 Karma

sloshburch
Splunk Employee
Splunk Employee

Also, make sure that you reload the page and remove any tokens from the URL while editing. Sometimes you get unexpected behavior because the tokens still live in the URL even though you thought you're looking at a clean page after saving it.

woodcock
Esteemed Legend

I was just going to say this. It is a HUGELY common mistake.

0 Karma

g038123
Explorer

Thank you for that 😉 and for the Dashboard examples app recommendation.
It is very helpful!!

0 Karma

woodcock
Esteemed Legend

Do yourself a favor and download the "Splunk 6.x Dashboard Examples" app and go through it.

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...