Dashboards & Visualizations

Dashboard conditional search not working

nareshinsvu
Builder

Hello experts,

I am trying to dynamically change my dashboard view based on 3 dropdown inputs. All the time, my show_tab1 results are hidden even if the condition matches. Any help to tweak the code is appreciated.

  <row>
<panel>
  <table depends="$hide_table$">
    <search>
                <query> | from datamodel:"0DP_T_common" | search C_Category=$selected_cat$ C_endpoint="$selected_endpoint$" C_Response=$selected_response$ |  table C_Day C_StartTime C_Category C_endpoint C_Response duration</query>
      <earliest>0</earliest>
      <sampleRatio>1</sampleRatio>
      <done>
     <condition match="$result.selected_cat$=Categ_1 AND $result.selected_endpoint$=prime AND $result.selected_response$=00">
      <unset token="hide_table"></unset>
      <set token="show_tab1">true</set>
     </condition>
     <condition>
       <set token="hide_table">true</set>
       <unset token="show_tab1"></unset>
     </condition>
      </done>
     </search>
  </table>
  <table depends="$show_tab1$">
    <search>
      <query> | from datamodel:"0DP_T_selected" | search C_Category=$selected_cat$ C_endpoint="$selected_endpoint$" C_Response=$selected_response$ |  table C_Day C_StartTime C_Category C_endpoint C_Response duration</query>
      <earliest>0</earliest>
      <sampleRatio>1</sampleRatio>
     </search>
   </table>
</panel>
Tags (1)
0 Karma
1 Solution

renjith_nair
Legend

@nareshinsvu ,

You may use depends and rejects instead of using two tokens. But two tokens should work as well.

In your condition , you are validating $result.selected_cat$ , $result.selected_endpoint$ and $result.selected_response$ but those are not part of your result set , instead the fields are C_Category , C_endpoint and C_Response. So replace the token names with the fields from the search result.

i.e. try

<condition match="$result.C_Category$=Categ_1 AND $result.C_endpoint$=prime AND $result.C_Response$=00">
Happy Splunking!

View solution in original post

0 Karma

vnravikumar
Champion

Hi @nareshinsvu

Are you want to show/hide panel based on three dropdowns or based on query result?

0 Karma

nareshinsvu
Builder

@vnravikumar - I wanted different searches for different set of Dropdowns actually.

0 Karma

nareshinsvu
Builder

@vnravikumar - Any further help is much appreciated.

0 Karma

renjith_nair
Legend

@nareshinsvu ,

You may use depends and rejects instead of using two tokens. But two tokens should work as well.

In your condition , you are validating $result.selected_cat$ , $result.selected_endpoint$ and $result.selected_response$ but those are not part of your result set , instead the fields are C_Category , C_endpoint and C_Response. So replace the token names with the fields from the search result.

i.e. try

<condition match="$result.C_Category$=Categ_1 AND $result.C_endpoint$=prime AND $result.C_Response$=00">
Happy Splunking!
0 Karma

nareshinsvu
Builder

Hi @renjith.nair ,

No Luck. I am getting the same result even after changing the condition as you mentioned.

Thanks,
Naresh

0 Karma

renjith_nair
Legend

@nareshinsvu ,

Put the text in quotes

ie.

<condition match='$result.C_Category$="Categ_1" AND $result.C_endpoint$="prime" AND $result.C_Response$="00"'>
Happy Splunking!
0 Karma

renjith_nair
Legend

Working example

<form>
  <label>Token settings</label>
  <fieldset submitButton="false">
    <input type="text" token="category">
      <label>Category</label>
    </input>
  </fieldset>
  <row>
    <panel>
      <table depends="$hide_table$">
        <title>First Table</title>
        <search>
          <query>|makeresults|eval C_Category="$category$", C_endpoint="prime", C_Response="00" |  table C_Category C_endpoint C_Response duration</query>
          <earliest>0</earliest>
          <sampleRatio>1</sampleRatio>
          <done>
            <condition match="$result.C_Category$=&quot;Categ_1&quot; AND $result.C_endpoint$=&quot;prime&quot; AND $result.C_Response$=&quot;00&quot;">
              <unset token="hide_table"></unset>
              <set token="show_tab1">true</set>
            </condition>
            <condition>
              <set token="hide_table">true</set>
              <unset token="show_tab1"></unset>
            </condition>
          </done>
        </search>
      </table>
      <table depends="$show_tab1$">
        <title>Second table</title>
        <search>
          <query>|makeresults|eval C_Category="Categ_2", C_endpoint="prime1", C_Response="00" |  table C_Category C_endpoint C_Response duration</query>
          <earliest>0</earliest>
          <sampleRatio>1</sampleRatio>
        </search>
      </table>
    </panel>
  </row>
</form>

Any input other than Categ_1 will result in first table and second table only when Categ_1 in text box

Happy Splunking!
0 Karma

nareshinsvu
Builder

Awesome @renjith.nair . It works. Is there alternate way to drive this using the dropdown values rather than the search query values?

Also you mentioned about depends and rejects. How to use that approach?

0 Karma

nareshinsvu
Builder

@renjith.nair - Any further help is much appreciated. Looking for the conditional search on dropdown values rather than the search results.

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...