Dashboards & Visualizations

How to remove token code from splunk panel xml when not in use?

ssjabid
Explorer

Hi,
I am trying to create a dashboard with 2 drop down filters,

The issue is, is that I have a lingering hidden drop down panel which I only want to appear when a specific value from the 1st drop down is picked
Now when the 2nd drop down appears, I want to be able to further filter the entire dashboard based on its values,
However the annoying this is, is that the the 2nd drop downs values stick to the entire dashboard even when it is hidden, I only want its filtering capabilities to be enabled when the 1st drop downs specific value is picked,
So I think a solution would be to find a way to unset the token or remove that line of code in the search when the 2nd drop down is hidden however I can't seem to figure out a way to do this. I am using Splunk 6.5

Here is the current code for the drop downs

<input type="dropdown" token="journey_tkn" searchWhenChanged="true">
<label>Journey</label>
<choice value="*">NGA+MCA</choice>
<choice value="NGA">NGA</choice>
<choice value="MCA">MCA</choice>
<prefix>Journey=</prefix>
<default>NGA+MCA</default>
<initialValue>*</initialValue>
<change>
<condition label="MCA">
 <set token="nga_show_tkn"></set>
 <unset token="nga_hide_tkn"></unset>
 </condition>
 <condition label="NGA">
 <unset token="nga_show_tkn"></unset>
 <set token="nga_hide_tkn"></set>
 </condition>
 <condition label="*">
 <unset token="nga_show_tkn"></unset>
 <set token="nga_hide_tkn"></set>
 </condition>
 </change>
</input>
<input type="dropdown" token="mcatkn" searchWhenChanged="false" depends="$nga_show_tkn$">
  <label>MCA Type</label>
  <choice value="Telephony">Telephony</choice>
  <choice value="Branch">Branch</choice>
  <choice value="*">*</choice>
  <prefix>MCAType=</prefix>
  <suffix></suffix>
  <change>
  <condition value="*">
    <unset token="mcatkn"></unset>
  </condition>
  </change>
</input>

and here is a sample search which uses the tokens from the drop downs

$tkn_index$  REQ="* " CLS="*" MSG="Get product types request handler ends"
| eval Journey=if(CH="****Retail" OR CH="****Retail" OR CH="****Retail" OR CH="****Retail", "NGA", "MCA")
| eval MCAType=case(CH="****RetailBranch" OR CH="****RetailBranch" OR CH="****RetailBranch" OR CH="****RetailBranch", 
"Branch", CH="****RetailTelephony" OR CH="****RetailTelephony" OR CH="****RetailTelephony" OR CH="****RetailTelephony", 
"Telephony")
| search $journey_tkn$ $mcatkn$
| stats dc(SID) as UniqueSessionCount

So I'd like to get get rid of $mcatkn$ when the 2nd dropdown is not in use (i.e hidden) because that causes there to be lingering filtering in the dashboard, I only want the 2nd dropdowns filter to be applied when the 1st drop downs specific value has been chosen (in this case when mca is picked, I want the 2nd dropdown panel to be displayed which it is, and then I want to be able to filter by Telephony or Branch, however when the 1st dropdown has nga or nga+mca picked, I want the 2nd drop down to disappear as well as the lingering filter being applied by it,

I hope this makes sense,
Any help will be greatly appreciated!
Please do help 🙂

0 Karma
1 Solution

Sukisen1981
Champion

hmm you are unhiding the second dropdown only on the condition that the first dropdown value is selected as MCA, for the rest 2 options, MCA+NGA and * nothing happens..
can you assign the token under unset in the first drop down token?

 <change>
      <condition label="MCA">
        <set token="nga_show_tkn"></set>
        <unset token="nga_hide_tkn"></unset>
      </condition>
      <condition label="NGA">
        <unset token="nga_show_tkn"></unset>
           **<eval token="mcatkn">""</eval>**
        <set token="nga_hide_tkn"></set>
      </condition>
      <condition label="*">
        <unset token="nga_show_tkn"></unset>
           **<eval token="mcatkn">""</eval>**
        <set token="nga_hide_tkn"></set>
      </condition>
    </change>

Bscially as soon as you unset the token for the 2nd drop down in the first drop down, immediately set the mactkn to ""

View solution in original post

Sukisen1981
Champion

hmm you are unhiding the second dropdown only on the condition that the first dropdown value is selected as MCA, for the rest 2 options, MCA+NGA and * nothing happens..
can you assign the token under unset in the first drop down token?

 <change>
      <condition label="MCA">
        <set token="nga_show_tkn"></set>
        <unset token="nga_hide_tkn"></unset>
      </condition>
      <condition label="NGA">
        <unset token="nga_show_tkn"></unset>
           **<eval token="mcatkn">""</eval>**
        <set token="nga_hide_tkn"></set>
      </condition>
      <condition label="*">
        <unset token="nga_show_tkn"></unset>
           **<eval token="mcatkn">""</eval>**
        <set token="nga_hide_tkn"></set>
      </condition>
    </change>

Bscially as soon as you unset the token for the 2nd drop down in the first drop down, immediately set the mactkn to ""

ssjabid
Explorer

Legend! it works, can you please explain exactly what happens when this is added? I don't entirely understand!

0 Karma

Sukisen1981
Champion

you are using nga_show_tkn to hide/unhide the second panel. Now, you are NOT doing this in the second drop down, you are setting /unsetting the value in the first dropdown. So, all I did was assign the token value mcatkn just under the lines of code where you hide nga_show_tkn .

Remember, you have 2 tokens in the second dropdown - one is nga_show_tkn , which is for merely hiding / unhiding the second dropdown BUT you also have the token mcatkn , which is what takes a value and is used for processing in the further panels. The entire code in your second dropdown between the input tags, never gets executed for any other drop down value than MCA (selected from the first drop down token), hence when you select the other values NGA or *(MCA+NGA) nothing really gets executed in the second drop down.

Also and importantly set/unset token is a like a Boolean flag ( it is like a 1 or 0 flag for the depends token , nga_show_tkn ) set makes the flag 1 - displays your second drop down and unset makes the flag 0 - hides your secodn dropdown. You can't really use set/unset to assign values to a token, mcatkn in this case. So what I did was merely assign (using an eval NOT set/unset) mcatkn ="" or NULL which got executed immediately after you hid (unset) the nga_show_tkn token, which is what is needed - when you hide the second dropdown by assigning mcatkn to "" or NULL i just sorta 'cleared' or reset all hitherto existing values associated with the mcatkn token.

Hope this helps 🙂

0 Karma

ssjabid
Explorer

ah mate, you legend, that makes sense,
So ultimately, going forward, when i want to replace a token value in my code, I will use the eval command to fix a value to it? (in this case i wanted to execute the change after I unset the first drop down token?)

Really appreciate the help!

0 Karma

Sukisen1981
Champion

yeah, thumb rule
hide/unhide - use set/unset
assign values / default to values / clear up and re-initialize values - use eval

0 Karma

ssjabid
Explorer

excellent, well i'm close to what we want now 🙂

1 problem I've noticed though is that, by default, i want to be able to set mcatkn to ""
but when the dashboard is accessed, the token still appears until I've set the first dropdown tkn to mca and back to nga+mca,

It's weird, but how can i make it so that mcatkn token is "" originally? (i.e not there until I've set the dropdown to nga

I hope this makes sense

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...