1 This isn't a dropdown, its a pie chart where the user clicks on a slice and then a subsequent drilldown happens.

dbcase · ‎12-19-2017

Hi,

I am setting a token to 3 different values and then displaying graphs/charts based upon those values. lets call the token values A,B and C. So far so good. One catch is if the value is C then the subsequent graphs don't have anything to display.

Example. The queries display account numbers, but the value for C is invalid account number (aka null) so the resulting charts are all blank. What I'd like to do is if the token is =C then unset the token so the resulting charts never show.

something like this pseudo code

drilldown
set token my token
if mytoken=c unset mytoken

Is there a way to do this?

nikita_p · ‎12-19-2017

Hi dbcase,
Can you try with this in your search query?
base search..|eval mytoken=case(mytoken=A, "A", mytoken=B, "B", mytoken=C, "null"))) | search mytoken!=C

dbcase · ‎12-20-2017

Hi Nikita_p,

I think that would work but...... I have a panel that shows once the token is set what I'm trying to do is if a user clicks on a certain pie slice don't do anything. This will require unsetting the token before the drilldown panel so it won't show up.

niketn · ‎12-19-2017

@dbcase, we would be able to help you with what you need based on how you are setting the token in dropdown and then using the token in your search. Would it be possible for you to add your existing code?

Based on the description you can try the following run anywhere dashboard to see if it fits the need:

<form>
  <label>Set Unset token on Drilldown change</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="tokAccount" searchWhenChanged="true">
      <label>Select Account</label>
      <choice value="1234">A</choice>
      <choice value="2345">B</choice>
      <choice value="">C</choice>
      <change>
        <condition label="A">
          <set token="tokShowChart">true</set>
        </condition>
        <condition label="B">
          <set token="tokShowChart">true</set>
        </condition>
        <condition label="C">
          <unset token="tokShowChart"></unset>
        </condition>
        <condition>
          <unset token="tokShowChart"></unset>
        </condition>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <html depends="$tokShowChart$">
        <div>
          tokAccount: $tokAccount$
        </div>
        <div>
          tokShowChart: $tokShowChart$
        </div>
      </html>
    </panel>
  </row>
</form>

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

dbcase · ‎12-20-2017

Hi Niketnilay,

I don't have the code quite yet but I can clarify a bit....

1 This isn't a dropdown, its a pie chart where the user clicks on a slice and then a subsequent drilldown happens.

2 One of the pie chart slices is Invalid URL (i.e. it is a null url), which breaks the drilldown because the drilldown shows the url and if there isn't one the search fails

What I'd like to do is if the user clicks on that slice, do nothing. Or as a second option, display a panel that says "Can't do this because there is no URL to report" or something of the likes.....

dbcase · ‎12-20-2017

wow dunno why it was big and bold like that....

dbcase · ‎12-20-2017

here is the current dashboard code. Please note the comments embedded below beginning with --

   <panel>
      <title>Camera errors</title>
      <chart>
        <title>Click for additional detail</title>
        <search>
          <query>index=wholesale_app DynamicChoice Properties.index=3 buildTarget=$mso_selection$ product=$Product_token$|stats count by Properties.args{}| appendpipe [stats count | where count=0]</query>
          <earliest>$time_field.earliest$</earliest>
          <latest>$time_field.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>


----- This is where I'm setting the token based upon the user clicking a pie slice

        <drilldown>
          <set token="showcameraerrorsdetail">$click.value$</set>

-- What I need to do here is, if the token is equal to "Invalid_Token" then unset the token

        </drilldown>
      </chart>
    </panel>

  </row>
  <row>

--- This is where I display the panel based upon if the token is set

    <panel depends="$showcameraerrorsdetail$">
      <title>Camera error $showcameraerrorsdetail$</title>
      <table>
        <title>(Click any row to close)</title>
        <search>
          <query>index=wholesale_app [ search index=wholesale_app DynamicChoice Properties.index=3 buildTarget=* product=* $showcameraerrorsdetail$ | table clientSessionId] | rename Properties.args{} as properties | rex "(?&lt;accountid&gt;\w+)..,..customerId"| eval url=if('Properties.index'="0" AND 'analyticType'="DynamicChoice", properties, NULL)| stats list(accountid) AS accountid, values(url) AS url BY clientSessionId |where len(url)&gt;1|fields - clientSessionId|rename accountid as "Account ID" url as URL</query>
          <earliest>$time_field.earliest$</earliest>
          <latest>$time_field.latest$</latest>
        </search>
        <drilldown>
          <unset token="showcameraerrorsdetail"></unset>
        </drilldown>
      </table>
    </panel>

niketn · ‎12-28-2017

@dbcase, such details in question really helps us a lot in proposing the solution. Your requirement seemed to have completely changed from original request.

Based on further details provided is Properties.args{} which will have valid URL in two cases and null in third case? Do you want to show null in your pie chart in the first place? In case you do what is the value you want to pass for the URL to the drilldown, when the cell with null value in the URL is clicked?

Can you add the sample data for the field? Also, if possible, add a screenshot of the pie as to what you currently have for the drilldown.

Try the following run anywhere code:

<dashboard>
  <label>Unset Token based on pie chart drilldown value</label>
  <row>
    <panel>
      <chart>
        <search>
          <query>| makeresults
| eval URL="http://someurl.com/A",count=30
|append[| makeresults
| eval URL="http://someurl.com/B",count=40]
|append[| makeresults
| eval URL="NULL",count=20]
| fields - _time</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.abbreviation">none</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.abbreviation">none</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.abbreviation">none</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">pie</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.mode">standard</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.lineWidth">2</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
        <drilldown>
          <condition match="$click.value$==&quot;NULL&quot;">
            <unset token="showcameraerrorsdetail"></unset>
          </condition>
          <condition>
            <set token="showcameraerrorsdetail">$click.value$</set>
          </condition>
        </drilldown>
      </chart>
    </panel>
  </row>
  <row>
    <panel>
      <title>$showcameraerrorsdetail$</title>
      <html>
        <!-- Dummy Panel Content -->
      </html>
    </panel>
  </row>
</dashboard>

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

Unset a token if it is equal to a value

1 This isn't a dropdown, its a pie chart where the user clicks on a slice and then a subsequent drilldown happens.

2 One of the pie chart slices is Invalid URL (i.e. it is a null url), which breaks the drilldown because the drilldown shows the url and if there isn't one the search fails

Introducing the 2024 SplunkTrust!

Introducing the 2024 Splunk MVPs!

Splunk Custom Visualizations App End of Life