Dashboards & Visualizations

How can I set a default "yes" radio button that can change to "no" with user input?

dbcase
Motivator

Hi,

I have a panel where I need to display a bar graph of filtered results by default. The search works just great. What I need to do is put a radio button in the panel (I already know how to go about this) and have it default to yes and run the yes query and display the results. That is easy enough and I can get that working. The part that I need that I don't know how to do is when the user selects no on the radio button how do I run a separate query that displays results that are not filtered (I have the query just don't know how to run it when the radio button selection is "no"). I don't want a second panel. I'd like to do this in the same panel.

Any thoughts?

0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

HI

Can you please try below dashboard XML?

<dashboard>
  <fieldset submitButton="false">
    <input type="radio" token="field1">
      <label>field1</label>
      <choice value="Yes">Yes</choice>
      <choice value="No">No</choice>
      <default>Yes</default>
      <change>
        <condition value="Yes">
          <set token="myseaerch">index=_internal | stats count by sourcetype </set>
        </condition>
        <condition value="No">
          <set token="myseaerch">index=_internal | stats count by source </set>
        </condition>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>$myseaerch$</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</dashboard>

I hope it will help you.

Thanks

View solution in original post

kamlesh_vaghela
SplunkTrust
SplunkTrust

HI

Can you please try below dashboard XML?

<dashboard>
  <fieldset submitButton="false">
    <input type="radio" token="field1">
      <label>field1</label>
      <choice value="Yes">Yes</choice>
      <choice value="No">No</choice>
      <default>Yes</default>
      <change>
        <condition value="Yes">
          <set token="myseaerch">index=_internal | stats count by sourcetype </set>
        </condition>
        <condition value="No">
          <set token="myseaerch">index=_internal | stats count by source </set>
        </condition>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>$myseaerch$</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</dashboard>

I hope it will help you.

Thanks

dbcase
Motivator

Wow, thank you Kamlesh! That is 99.9%! One last minor question.

If the radio button is Yes, then display a bar chart and if it is no display a table. Is there a way to do that?

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

Hi
Yes, we can do it.

Please try below XML.

<form>
  <fieldset submitButton="false">
    <input type="radio" token="field1">
      <label>field1</label>
      <choice value="Yes">Yes</choice>
      <choice value="No">No</choice>
      <default>Yes</default>
      <change>
        <condition value="Yes">
          <set token="myseaerch">index=_internal | stats count by sourcetype</set>
          <set token="forBarchart"> </set>
          <unset token="forTable"> </unset>
        </condition>
        <condition value="No">
          <set token="myseaerch">index=_internal | stats count by source</set>
          <set token="forTable"> </set>
          <unset token="forBarchart"> </unset>
        </condition>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <table depends="$forTable$">
        <search>
          <query>$myseaerch$</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
      <chart depends="$forBarchart$">
        <search>
          <query>$myseaerch$</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.chart">column</option>
        <option name="charting.drilldown">none</option>
      </chart>
    </panel>
  </row>
</form>

Happy Splunking

niketn
Legend

@kamlesh_vaghela, it is better to use search query token itself as depends. In your case both queries will run irrespective of which panel is being displayed. However, it is better to run the search only for the panel for which token is set. Following is based on your code.

<form>
  <label>Radio Button to Switch Search And Panel</label>
  <fieldset submitButton="false">
    <input type="radio" token="field1">
      <label>field1</label>
      <choice value="Yes">Yes</choice>
      <choice value="No">No</choice>
      <default>Yes</default>
      <change>
        <condition value="Yes">
          <set token="tokSearchQueryPanel1">index=_internal | stats count by sourcetype</set>
          <unset token="tokSearchQueryPanel2"></unset>
        </condition>
        <condition value="No">
          <set token="tokSearchQueryPanel2">index=_internal | stats count by sourcetype</set>
          <unset token="tokSearchQueryPanel1"></unset>
        </condition>
      </change>
    </input>
  </fieldset>
  <row>
    <panel depends="$tokSearchQueryPanel1$">
      <title>Panel 1 - Bar Chart</title>
      <chart>
        <search>
          <query>$tokSearchQueryPanel1$</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.chart">bar</option>
        <option name="charting.drilldown">none</option>
      </chart>
    </panel>
    <panel depends="$tokSearchQueryPanel2$">
      <title>Panel 2 - Table</title>
      <table>
        <search>
          <query>$tokSearchQueryPanel2$</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</form>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

gongya
Engager

thanks a lot !!

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@niketnilay,

yes, It's batter.

@dbcase,
Can you please try this?

0 Karma

dbcase
Motivator

That is PERFECT! Many thanks to both of you!!!

0 Karma

niketn
Legend

@dbcase, please accept the answer by @kamlesh_vaghela to mark as answered and up vote the comments that helped.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

somesoni2
SplunkTrust
SplunkTrust

How big are your queries? Are they similar with some changes OR they're completely different? How much time they take to execute?

0 Karma

dbcase
Motivator

Hi Somesoni2,

The "yes" (aka filtered) query looks like this

index=cg_troubles|rex "(?i) PREMISE_FK=\"(?P<premise>[^\"]+)"|rex "(?i) EVENT_TYPE=\"(?P<event_type>[^\"]+)"|rex "(?i) .*?=\"(?P<EVENT_SUB_TYPE>[a-z]+)(?=\")"|stats max(_time) as Time 
         max(eval(case(EVENT_SUB_TYPE="com",_time))) as comTime 
         max(eval(case(EVENT_SUB_TYPE="comRes",_time))) as resTime 
    values(event_type) as et values(EVENT_SUB_TYPE) as est by premise  
 | where isnull(resTime) OR resTime<comTime
 | rename Time as _time|eval ts=et+" - "+est|stats count by ts|sort by -count|head 10

The "no"/unfiltered query uses the same index but the query itself is much smaller and radically different (i.e. simpler)

0 Karma

dbcase
Motivator
0 Karma

somesoni2
SplunkTrust
SplunkTrust

I was thinking on the same line but it requires that both queries differ slightly only so that difference can be tokenized. Do you mind sharing your second query as well?
Other option could be to merge both the queries the filter results based on radio input selection. Another option would to be set two different tokens based on radio input selection, have two panels running two searches and you show the panel (using depends attribute) based on radio input selection.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...