Dashboards & Visualizations

Dashboard conditional search not working

nareshinsvu
Builder

Hello experts,

I am trying to dynamically change my dashboard view based on 3 dropdown inputs. All the time, my show_tab1 results are hidden even if the condition matches. Any help to tweak the code is appreciated.

  <row>
<panel>
  <table depends="$hide_table$">
    <search>
                <query> | from datamodel:"0DP_T_common" | search C_Category=$selected_cat$ C_endpoint="$selected_endpoint$" C_Response=$selected_response$ |  table C_Day C_StartTime C_Category C_endpoint C_Response duration</query>
      <earliest>0</earliest>
      <sampleRatio>1</sampleRatio>
      <done>
     <condition match="$result.selected_cat$=Categ_1 AND $result.selected_endpoint$=prime AND $result.selected_response$=00">
      <unset token="hide_table"></unset>
      <set token="show_tab1">true</set>
     </condition>
     <condition>
       <set token="hide_table">true</set>
       <unset token="show_tab1"></unset>
     </condition>
      </done>
     </search>
  </table>
  <table depends="$show_tab1$">
    <search>
      <query> | from datamodel:"0DP_T_selected" | search C_Category=$selected_cat$ C_endpoint="$selected_endpoint$" C_Response=$selected_response$ |  table C_Day C_StartTime C_Category C_endpoint C_Response duration</query>
      <earliest>0</earliest>
      <sampleRatio>1</sampleRatio>
     </search>
   </table>
</panel>
Tags (1)
0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

@nareshinsvu ,

You may use depends and rejects instead of using two tokens. But two tokens should work as well.

In your condition , you are validating $result.selected_cat$ , $result.selected_endpoint$ and $result.selected_response$ but those are not part of your result set , instead the fields are C_Category , C_endpoint and C_Response. So replace the token names with the fields from the search result.

i.e. try

<condition match="$result.C_Category$=Categ_1 AND $result.C_endpoint$=prime AND $result.C_Response$=00">
Happy Splunking!

View solution in original post

0 Karma

vnravikumar
Champion

Hi @nareshinsvu

Are you want to show/hide panel based on three dropdowns or based on query result?

0 Karma

nareshinsvu
Builder

@vnravikumar - I wanted different searches for different set of Dropdowns actually.

0 Karma

nareshinsvu
Builder

@vnravikumar - Any further help is much appreciated.

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@nareshinsvu ,

You may use depends and rejects instead of using two tokens. But two tokens should work as well.

In your condition , you are validating $result.selected_cat$ , $result.selected_endpoint$ and $result.selected_response$ but those are not part of your result set , instead the fields are C_Category , C_endpoint and C_Response. So replace the token names with the fields from the search result.

i.e. try

<condition match="$result.C_Category$=Categ_1 AND $result.C_endpoint$=prime AND $result.C_Response$=00">
Happy Splunking!
0 Karma

nareshinsvu
Builder

Hi @renjith.nair ,

No Luck. I am getting the same result even after changing the condition as you mentioned.

Thanks,
Naresh

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@nareshinsvu ,

Put the text in quotes

ie.

<condition match='$result.C_Category$="Categ_1" AND $result.C_endpoint$="prime" AND $result.C_Response$="00"'>
Happy Splunking!
0 Karma

renjith_nair
SplunkTrust
SplunkTrust

Working example

<form>
  <label>Token settings</label>
  <fieldset submitButton="false">
    <input type="text" token="category">
      <label>Category</label>
    </input>
  </fieldset>
  <row>
    <panel>
      <table depends="$hide_table$">
        <title>First Table</title>
        <search>
          <query>|makeresults|eval C_Category="$category$", C_endpoint="prime", C_Response="00" |  table C_Category C_endpoint C_Response duration</query>
          <earliest>0</earliest>
          <sampleRatio>1</sampleRatio>
          <done>
            <condition match="$result.C_Category$=&quot;Categ_1&quot; AND $result.C_endpoint$=&quot;prime&quot; AND $result.C_Response$=&quot;00&quot;">
              <unset token="hide_table"></unset>
              <set token="show_tab1">true</set>
            </condition>
            <condition>
              <set token="hide_table">true</set>
              <unset token="show_tab1"></unset>
            </condition>
          </done>
        </search>
      </table>
      <table depends="$show_tab1$">
        <title>Second table</title>
        <search>
          <query>|makeresults|eval C_Category="Categ_2", C_endpoint="prime1", C_Response="00" |  table C_Category C_endpoint C_Response duration</query>
          <earliest>0</earliest>
          <sampleRatio>1</sampleRatio>
        </search>
      </table>
    </panel>
  </row>
</form>

Any input other than Categ_1 will result in first table and second table only when Categ_1 in text box

Happy Splunking!
0 Karma

nareshinsvu
Builder

Awesome @renjith.nair . It works. Is there alternate way to drive this using the dropdown values rather than the search query values?

Also you mentioned about depends and rejects. How to use that approach?

0 Karma

nareshinsvu
Builder

@renjith.nair - Any further help is much appreciated. Looking for the conditional search on dropdown values rather than the search results.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...