- Splunk Answers
- :
- Using Splunk
- :
- Dashboards & Visualizations
- :
- How can I toggle between results of different dril...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Drilldown: I have two rows in table and want to drill down another panel in same dashboards. if i click on row1 drilldown should have to give one results. if i click row2 I want drilldown2 results
i have a table with 2 rows. if i click the row1 i want the results of drilldown1 and same vice versa if i click row2 i want the results of 2nd drill down panel in the same dashboards
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You can create the following drilldown in your table
<drilldown>
<condition field="GROUP">
<eval token="token1">case($row.GROUP$="abc","true")</eval>
<eval token="token2">case($row.GROUP$="bbc","true")</eval>
</condition>
</drilldown>
PS: Change values abc and bbcas per your actual field values.
Then you can hide two charts using depends with token1 and token2 i.e.
<chart depends="$token1$">
AND
<chart depends="$token2$">
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You can create the following drilldown in your table
<drilldown>
<condition field="GROUP">
<eval token="token1">case($row.GROUP$="abc","true")</eval>
<eval token="token2">case($row.GROUP$="bbc","true")</eval>
</condition>
</drilldown>
PS: Change values abc and bbcas per your actual field values.
Then you can hide two charts using depends with token1 and token2 i.e.
<chart depends="$token1$">
AND
<chart depends="$token2$">
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
it working fine.
how to unset both token in single button click?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If you want to code a button (either Submit or your own Reset button) to unset the token you will have to use Simple XML JavaScript extension.
If you are fine using a checkbox for the same kind of functionality, you can try out the following code:
Hide Charts
<condition value="unset">
<unset token="token1"></unset>
<unset token="token2"></unset>
<unset token="form.unsetTokens"></unset>
</condition>
Change event handler of the Checkbox unsetTokens is used to unset the tokens i.e. token1 and token2. The form level token for checkbox itself i.e. form.unsetTokens is unset to reset the check in the checkbox to give it click kind of feel.
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
below is my HTML for my button. here where i should add above unset token commands
<panel>
<html>
<button class="butn6" data-unset-token="sourcetype1" >show less details</button>
<search>
</search>
</html>
</panel>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@premranjithj, above example is from SimpleXML using checkbox, which does not require HTML code.
If you want to add HTML button then you would need to use JavaScript Extension to Simple XML. Can you first try out and confirm adding a checkbox with change event containing above condition block to unset the tokens?
<input type="checkbox" token="unsetTokens" searchWhenChanged="true">
<label></label>
<choice value="unset">Hide All</choice>
<change>
<condition value="unset">
<unset token="token1"></unset>
<unset token="token2"></unset>
<unset token="form.unsetTokens"></unset>
</condition>
</change>
</input>
We can take the button with JavaScript as next step.
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@premjinath, I just checked one of my previous answers I have already mentioned how to create a Refresh button using HTML Panel in Splunk Simple XML dashboard.
<html>
<button id="refresh" type="button" class="btn">Refresh
<i class="icon-rotate" style="font-size: 1em;"></i>
</button>
</html>
You will need additional JavaScript code in the Dashboard to reset the tokens:
require([
"jquery",
"splunkjs/mvc/simplexml/eventhandler"
],
function(
$,
EventHandler
) {
//jQuery to capture Refresh button click event
$('#refresh').on("click", function() {
//Use EventHandler utiliy to unsetTokens
EventHandler.unsetToken("token1");
EventHandler.unsetToken("token2");
});
}
);
Please try out this one as well. You can use SimpleXML with Checkbox option or SimpleXML JS Extension with Refresh button.
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@niketnilay . thanks lot. it working
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@premranjithj, please upvote the comments that have helped since you have already accepted the answer.
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@niketnilay
i need another help.
i have 4 buttons and each button have 2 or 3 hidden panels.
so if i click button1 the hidden panels should be shown. if i click button2 other buttons panels show be hidden and only button2 panels have to visible and vice versa for all buttons
pls help how to do?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I think the code remains the same however, you set and unset tokens based on which button is being clicked.
You will additionally require "splunkjs/mvc" to use default or submitted token model.
// mvc.Components.get() function to get all default Tokens
var defaultTokenModel = mvc.Components.get("default");
//jQuery to capture Refresh button click event
$('#button1').on("click", function() {
defaultTokenModel.set("button1","true");
//Use EventHandler utiliy to unset Tokens
EventHandler.unsetToken("button2");
EventHandler.unsetToken("button3");
EventHandler.unsetToken("button4");
});
Similarly for other buttons.
Refer to Developer documentation: http://dev.splunk.com/view/webframework-developapps/SP-CAAAEW3
PS: The above code is not tested, so please refer to one of my other answers and Splunk Developer portal to understand the concepts: https://answers.splunk.com/answers/566582/how-to-hide-html-in-panel-when-multiple-tokens-are.html#an...
If it does not work let me know. And if it works dont forget to upvote 🙂
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@premranjithj, please confirm if you were able to try the unset code change as suggested. Did it work fine for you?
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You can set and unset token on the drilldown option. If you have first column with a key to identify a row and specific behavior, use the below syntax to compare the key and set and unset token .Use the same token to show/hide panels in the dashboard.
<drilldown>
<condition match="$row.colmnname$== value1">
<set token="token1">true</set>
<unset token="token2"></unset>
<condition>
<condition match="$row.colmnname$== value2">
<set token="token2">true</set>
<unset token="token1"></unset>
<condition>
</drilldown>
If u are facing issue with simple xml, paste the xml here, will and and fix it. Happy splunking 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
NEXT_PAY_PERIOD_NAME GROUP Total
APRW1-FY18 abc $8,768,545.49
APRW1-FY18 bbc $25,252,666.80
this is my table. if i click on the group column with abc. i have to get chart1 and if i click bbc i need to get chart 2 by unset chart1.
pls correct my code
<panel>
<title>Test</title>
<table>
<search>
<query>|abc.csv| stats sum(AMOUNT) as Total by NAME,GROUP|sort PERIOD|eval Total=round(Total,2)| fieldformat Total= "$" + tostring(Total, "commas")</query>
</search>
<drilldown>
<condition match="$row.colmnname$== value1">
<set token="token1">true</set>
<unset token="token2"></unset>
</condition>
<condition match="$row.colmnname$== value2">
<set token="token2">true</set>
<unset token="token1"></unset>
</condition>
</drilldown>
</table>
</panel>
</row>
<row>
<panel >
<chart depends="$token1$">
<search>
<query>|query|where PAY_GROUP="abc" | stats sum(PAYMENT_AMOUNT) as Total by CODE,PNAME, GROUP|sort- Total|eval Total=round(Total,2)|stats sum by CODE</query>
</search>
<option name="charting.chart">pie</option>
</chart>
</panel>
<panel >
<chart depends="$token2$">
<search>
<query>|query|where PAY_GROUP="abc" | stats sum(PAYMENT_AMOUNT) as Total by CODE,PNAME, GROUP|sort- Total|eval Total=round(Total,2)|stats sum by CODE</query>
</search>
<option name="charting.chart">pie</option>
</chart>
</panel>
</row>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
For Each dashboard/panel You can use separate drill down option giving DRILL DOWN report URL.
Panel/dashboard 1
Next Drill down for the same.
<single>
<search>
<query>index=xyz sourcetype=XXX | .....</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<!-- <title>abc</title> -->
<drilldown target="0000">
<link>
<![CDATA[URL]]>
<![CDATA[-]]>
<![CDATA[.. URL Continue]]>
</link>
</drilldown>
Above solution I am using for 16 panel dashboard.
Introducing the 2024 SplunkTrust!
Introducing the 2024 Splunk MVPs!
Splunk Custom Visualizations App End of Life
