Dashboards & Visualizations

If else condition for dashboard

tamduong16
Contributor

How can I do an if token=something then run this query for the panel and else to run another query for that same panel?
So I have the following query:

query 1:
index="monthlycdr" $result0sec$ $result$ | eval "Call Duration"=replace('Call Duration',"\"","") | convert dur2sec("Call Duration") as "CDinsec" | eval "Name"=replace('Name',"\"","") | eval "Name" = substr(Name,1,3)
| eval "Name" = upper(Name)
| rex field=Name mode=sed "s/AAA/APAC/g"
| rex field=Name mode=sed "s/ABC/ABCD3/g"
| rex field=Name mode=sed "s/CDF/CDF123/g"
| eval "transporttype"=replace('Transport Type',"\"","") | eval "Voice_count"=case( match(transporttype, "(?i)voice") OR match(transporttype, "(?i)pstn"), CDinsec)
| eval "Video_count" =case(match(transporttype, "^(?i)h323$$") OR match(transporttype, "^(?i)sip$$"),CDinsec)
| stats avg("Voice_count") as Avg_Voice, avg("Video_count") as Avg_Video, sum("Voice_count") as Sum_Voice, sum("Video_count") as Sum_Video by Name

query2:
index="monthlycdr" $result0sec$ $result$ | eval "Call Duration"=replace('Call Duration',"\"","") | convert dur2sec("Call Duration") as "CDinsec" | eval "Name"=replace('Name',"\"","") | eval "transporttype"=replace('Transport Type',"\"","") | eval "Voice_count"=case( match(transporttype, "(?i)voice") OR match(transporttype, "(?i)pstn"), CDinsec)
| eval "Video_count" =case(match(transporttype, "^(?i)h323$$") OR match(transporttype, "^(?i)sip$$"),CDinsec)
| stats avg("Voice_count") as Avg_Voice, avg("Video_count") as Avg_Video, sum("Voice_count") as Sum_Voice, sum("Video_count") as Sum_Video by Name

How can I make my dashboard panel to run query 1 if the token value is "All", and if else for query 2, else for maybe other query? Can I do this with splunk?
Thanks

1 Solution

cmerriman
Super Champion

something like this might get you started (you will need two panels, though, but only one will show based on the input):

<input type="type" token="token">
      <label>field1</label>
      <choice value="*">All</choice>
OTHER CHOICES
       <change>
         <condition>
            <set token="pan2">&#32;</set>
            <unset token="pan1"></unset></condition>
        <condition value="*">
            <set token="pan1">&#32;</set>
            <unset token="pan2"></unset>
          </condition>
        </change>
    </input>

then use $pan1$ and $pan2$ in the searches: index=monthlycdr $result0sec$ $result$ $pan1$

and use <panel depends=$pan1$> in the panel that has that token in it, etc. you might need to edit it a bit.
https://www.splunk.com/blog/2017/06/29/load-em-up-and-move-em-out-controlling-dashboard-panel-load-o...
this is a blog post for help on it.

View solution in original post

cmerriman
Super Champion

something like this might get you started (you will need two panels, though, but only one will show based on the input):

<input type="type" token="token">
      <label>field1</label>
      <choice value="*">All</choice>
OTHER CHOICES
       <change>
         <condition>
            <set token="pan2">&#32;</set>
            <unset token="pan1"></unset></condition>
        <condition value="*">
            <set token="pan1">&#32;</set>
            <unset token="pan2"></unset>
          </condition>
        </change>
    </input>

then use $pan1$ and $pan2$ in the searches: index=monthlycdr $result0sec$ $result$ $pan1$

and use <panel depends=$pan1$> in the panel that has that token in it, etc. you might need to edit it a bit.
https://www.splunk.com/blog/2017/06/29/load-em-up-and-move-em-out-controlling-dashboard-panel-load-o...
this is a blog post for help on it.

jkat54
SplunkTrust
SplunkTrust

You can also use <condition label="YOUR_CHOICE_LABEL"> which is good for when you have a choice of "All" with value of "*".

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

Put both panels in the same place, and set a token for depends in one, and for rejects in the other. When the token exists, the depends panel will show, when the token does NOT exist, then the rejects panel will show.

http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/Viz/tokens

http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/Viz/PanelreferenceforSimplifiedXML

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...