Dashboards & Visualizations

Chnaging panel query based on token

BearMormont
Path Finder

I have a dashboard with a base search that feeds a simple panel like below. Is it possible to change the <query> based on a token? For example, let's say the token $tknIncludeField2$ is set to false. I would want the query instead to read | stats list(Field1) by Field3

Is that possible?

<panel>
  <title>My Awesome Table</title>
  <table>
    <search base="base">
            <query>
                | stats list(Field1), list(Field2) by Field3
            </query>
    </search>
    <option name="count">10</option>
    <option name="dataOverlayMode">none</option>
    <option name="drilldown">none</option>
    <option name="percentagesRow">false</option>
    <option name="refresh.display">progressbar</option>
    <option name="rowNumbers">false</option>
    <option name="totalsRow">false</option>
    <option name="wrap">true</option>
  </table>
</panel>

Thanks!

0 Karma
1 Solution

damiensurat
Contributor

you sure can, what you would want to do is set or unset the token based on the condition.

https://docs.splunk.com/Documentation/Splunk/7.0.2/Viz/tokens

notice in the example below the logic to set and unset a token.

   <search id="search_logic">
      <query>$index_switcher$ |  top sourcetype</query>
      <earliest>-60m@m</earliest>`enter code here`
      <latest>now</latest>

      <progress>
           <!-- match attribute for condition uses eval-like expression (see Splunk search language 'eval' command) -->
           <!-- logic: if resultCount is 0, then show a static html element, and hide the chart element -->
           <condition match="'job.resultCount' == 0">
               <set token="show_html">true</set>
           </condition>
           <condition>
               <unset token="show_html"/>
           </condition>
       </progress>
   </search>

so in your situation:

          <condition match=$tknIncludeField2$== 0">
               <set token="field2">"list(Field1)"</set>
           </condition>
           <condition>
               <unset token="field2"/>
           </condition>

But it may be easier to just provide a multiselect form input and then use the values to populate the selectable fields. Here's an example that should do exactly as you are requesting based on your sample (of course you will still need the base query):

 <form>
   <label>a</label>
   <fieldset submitButton="false">
     <input type="multiselect" token="listFieldsChoice" searchWhenChanged="true">
       <label>Field Filter</label>
       <choice value="field1">Field1</choice>
       <choice value="field2">Field2</choice>
       <choice value="field3">Field3</choice>
       <valuePrefix>list(</valuePrefix>
       <valueSuffix>)</valueSuffix>
       <delimiter>, </delimiter>
     </input>
   </fieldset>
   <row>
       <panel>
           <title>My Awesome Table</title>
           <table>
               <search base="base">
               <query>
                 | stats $listFieldsChoice$ by Field3
               </query>
             </search>
             <option name="count">10</option>
             <option name="dataOverlayMode">none</option>
             <option name="drilldown">none</option>
             <option name="percentagesRow">false</option>
             <option name="refresh.display">progressbar</option>
             <option name="rowNumbers">false</option>
             <option name="totalsRow">false</option>
             <option name="wrap">true</option>
         </table>
     </panel>
  </row>
</form>

View solution in original post

damiensurat
Contributor

you sure can, what you would want to do is set or unset the token based on the condition.

https://docs.splunk.com/Documentation/Splunk/7.0.2/Viz/tokens

notice in the example below the logic to set and unset a token.

   <search id="search_logic">
      <query>$index_switcher$ |  top sourcetype</query>
      <earliest>-60m@m</earliest>`enter code here`
      <latest>now</latest>

      <progress>
           <!-- match attribute for condition uses eval-like expression (see Splunk search language 'eval' command) -->
           <!-- logic: if resultCount is 0, then show a static html element, and hide the chart element -->
           <condition match="'job.resultCount' == 0">
               <set token="show_html">true</set>
           </condition>
           <condition>
               <unset token="show_html"/>
           </condition>
       </progress>
   </search>

so in your situation:

          <condition match=$tknIncludeField2$== 0">
               <set token="field2">"list(Field1)"</set>
           </condition>
           <condition>
               <unset token="field2"/>
           </condition>

But it may be easier to just provide a multiselect form input and then use the values to populate the selectable fields. Here's an example that should do exactly as you are requesting based on your sample (of course you will still need the base query):

 <form>
   <label>a</label>
   <fieldset submitButton="false">
     <input type="multiselect" token="listFieldsChoice" searchWhenChanged="true">
       <label>Field Filter</label>
       <choice value="field1">Field1</choice>
       <choice value="field2">Field2</choice>
       <choice value="field3">Field3</choice>
       <valuePrefix>list(</valuePrefix>
       <valueSuffix>)</valueSuffix>
       <delimiter>, </delimiter>
     </input>
   </fieldset>
   <row>
       <panel>
           <title>My Awesome Table</title>
           <table>
               <search base="base">
               <query>
                 | stats $listFieldsChoice$ by Field3
               </query>
             </search>
             <option name="count">10</option>
             <option name="dataOverlayMode">none</option>
             <option name="drilldown">none</option>
             <option name="percentagesRow">false</option>
             <option name="refresh.display">progressbar</option>
             <option name="rowNumbers">false</option>
             <option name="totalsRow">false</option>
             <option name="wrap">true</option>
         </table>
     </panel>
  </row>
</form>

BearMormont
Path Finder

You rocked my face off!

This is EXACTLY what I needed!

damiensurat
Contributor

Haha. Great to hear BearMormont! Happy Splunking!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...