October 22, 2021

How to show a panel only after selection of value from another panel in Splunk?

Use Drilldown Editor:



Sample XML:
<form>
  <label>Sample Explore</label>
  <search id="Event_transcript_search">
    <query>PLEASE ENTER YOUR QUERY</query>
    <earliestTime>$earliest$</earliestTime>
    <latestTime>$latest$</latestTime>
  </search>
  <search id="Event_key_search">
    <query>
      PLEASE ENTER YOUR QUERY
    </query>
    <earliestTime>$earliest$</earliestTime>
    <latestTime>$latest$</latestTime>
  </search>
  <fieldset submitButton="true" autoRun="false">
    <input type="text" token="OrgId">
      <label>Org Id</label>
      <default></default>
    </input>
    <input type="text" token="sampleToken">
      <label>Sample</label>
      <default></default>
    </input>
    <input type="time">
      <label>Time Frame</label>
      <default>
        <earliest>-15m</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <title>Event Keys</title>
        <search base="Event_transcript_search">
          <query>PLEASE ENTER YOUR ADDITIONAL STATEMENTS IN THE QUERY</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">cell</option>
        <drilldown>
          <set token="EventKey">$click.value2$</set>
        </drilldown>

      </table>
    </panel>
  </row>
  <row>
    <panel depends="$EventKey$">
      <table>
        <title>Events - $EventKey$</title>
        <search base="Event_key_search">
          <query>PLEASE ENTER YOUR ADDITIONAL STATEMENTS IN THE QUERY</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">row</option>
      </table>
    </panel>
  </row>
</form>

In the above example, when a cell is clicked from that panel, it captures the value and stores it in EventKey toekn. Then, the next panel is displayed only after that. In the initial dashboard load, the panel won't be loaded as it depends on EventKey token.

No comments:

Post a Comment