Splunk Search

How to run search only for shown panels?

naty
Path Finder

Hi,

i have a dashboard with several panels.
i have used the "depends" option for every panel to see only those that i need.

what i have noticed is even though i have this option, still all the panels would start the search as soon as the page loads and not when only shown.

meaning, when i open the dashboard i see nothing.
i'm inputting some data for tokens (interval, time, etc).
then i choose the panels i would like to show.
for each panel i have used the depends and rejects options to see only those that matter to that subject.
i have noticed that after inputting all the data needed, all the panels would make their search, no matter if the depends is on them.

my goal is that only that shown panels would start the search and show their output.
we are using Splunk 6.5.1

How can it be done?

Thank you!

Tags (1)
0 Karma

naty
Path Finder

i found a workaround for this.
i'm initializing the tokens at the page load, so no panel is shown for the start.
this is how i achieved it:

<form>
    <init>
        <unset token="a"></unset>
        <unset token="b"></unset>
        <unset token="c"></unset>
        ...

      </init>
</form>

in the tag you can initialize many things, here is a link to the tag description:
http://docs.splunk.com/Documentation/Splunk/latest/Viz/tokens#Set_tokens_on_page_load

0 Karma

somesoni2
Revered Legend

Best option would be to include the depends token that you used for panel in the panel search, so that searches will not run untill that token is set (and thus panel is visible). E.g. If you're setting a token say $showPanel1$ with value say "Y", then in the base search (first portion) of the panel search, add a condition "$showPanel1$"="Y".

0 Karma

naty
Path Finder

can you give an example?
if i got it right, you mean something like this:
index=myind source=mysrc "$showPanel1$"="Y" | ...
but doesn't interfere with the search? i'm basically saying to splunk to search for event with showPanel=Y

0 Karma

somesoni2
Revered Legend

It won't. When the token value is evaluated, your search will look like this and should always work.

index=myind source=mysrc "Y"="Y" | ...

Another (better IMO) option you could do is to set value of $showPanel1$ as 1, then your search would look like this

index=myind source=mysrc $showPanel1=1 | ...

Upon evaluation, results in 1=1 which is always true.

index=myind source=mysrc 1=1 | ...
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...