Use of Token in Dashboard to run different panels one by one

[nkankur]

Hi All,

In my dashboard, the second panel depends on the output of the first one. Can someone please help me with the use of tokens to capture the result of the first panel and passes that value to the second one which then starts running.

Thanks a lot in advance! 🙂

[elliotproebstel · Accepted solution]

If you want the second panel to run immediately after the first panel returns search results (without a user clicking on anything), you are able to access search job properties or named fields in the first row of search results, as documented in the search event handlers guide.

If, for example, you'd like the second panel to run only if the number of results from the first panel was >5, then you could use the following structure in the code for the search in your first panel:

<search>...
  <done>
    <condition match="$job.resultCount$ > 5">
        <set token="show_panel">true</set>
    </condition>
    <condition>
        <unset token="show_panel"/>
    </condition>
  </done>
</search>

And then the second panel would need to use a depends clause to rely on that token in order to display:

<panel depends="$show_panel$>
...
</panel>

[nkankur]

Hi elliotproebstel, your solution is working as expected. Thanks for the solution.
There is one problem I am facing in this regard.

actually, I am creating a model in the first panel and then showing it's properties in the second one. Earlier both the panels were running at the same time hence the second one was throwing an error that the model doesn't exist.

Now as both the panels are running one by one then it should not through this error as of my understanding.

Can you please help with passing the model name as a token to the new panel to avoid this error message.

Thanks for your support 🙂

[elliotproebstel]

I'm happy to try! Can you give me an example of what the results might be in the first panel and what you'd like to pass to the second panel? There is one very limiting condition for how this can be done with only SimpleXML, which is that the search event handler will only be able to access the first row of results. So if your first panel is returning a single row - then no problem. We just need to identify the field name of the value you'd like to pass, and it will be straightforward. But if your first panel is returning more than a single row of results, you'll need to use JavaScript to achieve this, I believe.

If your first panel returns a single row of results and one field from that row is called model_name, and you'd like to pass that to the second panel, then the code above would change to this:

 <search>...
   <done>
     <condition match="$job.resultCount$ > 1">
         <set token="show_panel">true</set>
         <set token="model_name">$result.model_name|s$</set>
     </condition>
     <condition>
         <unset token="show_panel"/>
     </condition>
   </done>
 </search>

And then in your second panel's query, you'd reference model_name like this:

index=something sourecetype=blah model="$model_name$"

[nkankur]

AWESOME! Thanks a lot elliotproebstel
It's working now!

[nkankur]

Hi elliotproebstel
Can you please help me with one of my previous question labelled "TRANSFORMING TABLES"
I need to join 2 tables without a common field.
All rows of 1st table must join with all the rows of the second one.
I have also illustrated an example in that question's description.
Also link is also given below-
https://answers.splunk.com/answers/624552/transforming-table.html

[deepashri_123]

@nkankur,

Refer this accepted answer:
https://answers.splunk.com/answers/568483/drilldown-linking-passing-value-from-one-panel-to-1.html
Also refer this doc:
http://docs.splunk.com/Documentation/Splunk/7.0.2/Viz/tokens
Let me know if this helps!!

[p_gurav]

Hi,

Do you want something like this:

<dashboard>
  <row>
    <panel>
      <table>
        <title>Event counts by sourcetype</title>
        <search>
          <query>index=_internal | stats count by sourcetype</query>
        </search>
        <drilldown>
          <set token="show_panel">true</set>
          <set token="selected_value">$click.value$</set>
        </drilldown>
      </table>
    </panel>
    <panel depends="$show_panel$">
      <event>
        <title>Recent events for $selected_value$</title>
        <search>
          <query>index=_internal sourcetype=$selected_value$ </query>
          <earliest>$earliest$</earliest>
          <latest>$latest$</latest>
        </search>
        <option name="count">5</option>
      </event>
    </panel>
  </row>
</dashboard>

Refer this doc:
http://docs.splunk.com/Documentation/Splunk/7.0.2/Viz/ContextualDrilldown