Splunk Enterprise

How to achieve multiselect input to hide/show multiple panels?

mnj1809
Path Finder

Hello,

Panels are not showing/hiding based on the selection of the multiselect input.

<form>
<label>Multiselect input to hide/show multiple panels</label>
<search>
<query>
| makeresults
| fields - _time
| eval data="$service_tok$"
| eval condition=case(match(data,"\*"),"show_all",match(data,"Windows") AND match(data,"NIX") AND match(data,"VMWare"),"show_all",match(data,"Windows"),"Windows",match(data,"NIX"),"NIX",match(data,"VMWare"),"VMWare")
| eval show_all=case(condition="show_all","true")
| eval show_windows=case(condition="Windows" OR condition="show_all","true")
| eval show_nix=case(condition="NIX" OR condition="show_all","true")
| eval show_vmware=case(condition="VMWare" OR condition="show_all","true")
</query>
<done>
<condition match="$job.resultCount$!=0">
<eval token="tokShowAll">case(isnotnull($result.show_all$),$result.show_all$)</eval>
<eval token="tokShowWindows">case(isnotnull($result.show_windows$),$result.show_windows$)</eval>
<eval token="tokShowNIX">case(isnotnull($result.show_nix$),$result.show_nix$)</eval>
<eval token="tokShowVMWare">case(isnotnull($result.show_vmware$),$result.show_vmware$)</eval>
</condition>
<condition>
<unset token="tokShowAll"></unset>
<unset token="tokShowWindows"></unset>
<unset token="tokShowNIX"></unset>
<unset token="tokShowVMWare"></unset>
</condition>
</done>
</search>
<fieldset submitButton="false">
<input type="time" token="field1">
<label></label>
<default>
<earliest>-60m@m</earliest>
<latest>now</latest>
</default>
</input>
<input type="multiselect" token="service_tok" searchWhenChanged="true">
<label>Select a Service</label>
<choice value="*">All</choice>
<choice value="Windows">Windows</choice>
<choice value="NIX">NIX</choice>
<choice value="VMWare">VMWare</choice>
<change>
<unset token="tokShowAll"></unset>
<unset token="tokShowWindows"></unset>
<unset token="tokShowNIX"></unset>
<unset token="tokShowVMWare"></unset>
</change>
<default>*</default>
<initialValue>*</initialValue>
<delimiter> </delimiter>
</input>
</fieldset>
<row>
<panel>
<title></title>
</panel>
</row>
<row depends="$tokShowWindows$">
<panel>
<table>
<title>Windows Request Count</title>
<search>
<query>host=abcd source="/access.log*" | timechart span=1hr count by host</query>
<earliest>-4h@m</earliest>
<latest>now</latest>
</search>
</table>
</panel>
</row>
<row depends="$tokShowNIX$">
<panel>
<table>
<title>NIX Request Count</title>
<search>
<query>host=abcd source="access.log" | timechart span=1hr count by host</query>
<earliest>-4h@m</earliest>
<latest>now</latest>
</search>
</table>
</panel>
</row>
<row depends="$tokShowVMWare$">
<panel>
<table>
<title>VMWare Request Count</title>
<search>
<query>host=abcd source="access.log" | timechart span=1hr count by host</query>
<earliest>-4h@m</earliest>
<latest>now</latest>
</search>
</table>
</panel>
</row>
</form>

@ITWhisperer 

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
<form version="1.1">
  <label>Multiselect Choice</label>
  <fieldset submitButton="false" autoRun="true">
    <input type="multiselect" token="alloptions" searchWhenChanged="true">
      <label></label>
      <choice value="*">All</choice>
      <choice value="second_choice">second choice</choice>
      <choice value="third_choice">third choice</choice>
      <choice value="fourth_choice">fourth choice</choice>
      <choice value="fifth_choice">fifth choice</choice>
      <delimiter>,</delimiter>
      <change>
        <eval token="form.alloptions">case(mvcount('form.alloptions')=0,"*",mvcount('form.alloptions')&gt;1 AND mvfind('form.alloptions',"\\*")&gt;0,"*",mvcount('form.alloptions')&gt;1 AND mvfind('form.alloptions',"\\*")=0,mvfilter('form.alloptions'!="*"),1==1,'form.alloptions')</eval>
        <eval token="second">if(isnotnull(mvfind('form.alloptions',"second_choice")) OR isnotnull(mvfind('form.alloptions',"\\*")),1,null())</eval>
        <eval token="third">if(isnotnull(mvfind('form.alloptions',"third_choice")) OR isnotnull(mvfind('form.alloptions',"\\*")),1,null())</eval>
        <eval token="fourth">if(isnotnull(mvfind('form.alloptions',"fourth_choice")) OR isnotnull(mvfind('form.alloptions',"\\*")),1,null())</eval>
        <eval token="fifth">if(isnotnull(mvfind('form.alloptions',"fifth_choice")) OR isnotnull(mvfind('form.alloptions',"\\*")),1,null())</eval>
      </change>
    </input>
  </fieldset>
  <row>
    <panel depends="$second$">
      <html>
        <p>Second Panel</p>
      </html>
    </panel>
    <panel depends="$third$">
      <html>
        <p>Third Panel</p>
      </html>
    </panel>
    <panel depends="$fourth$">
      <html>
        <p>Fourth Panel</p>
      </html>
    </panel>
    <panel depends="$fifth$">
      <html>
        <p>Fifth Panel</p>
      </html>
    </panel>
  </row>
</form>

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Please explain what each part of the dashboard is trying to do and how it is trying to do it?

0 Karma

mnj1809
Path Finder

Thanks for your prompt response.
I just want to show and hide panels based on the selection of values in Multiselect Input. For example, If I select "Windows" in the multiselect input then only panel "Windows Request Count" should be shown and if I select "Windows" and "NIX" in the multiselect input then panels "Windows Request Count" and NIX Request Count" should be shown.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Add a change handler to the multiselect to set the appropriate tokens based on the selection.

0 Karma

mnj1809
Path Finder

As you can see in my shared dashboard xml, I've added the change handler but it's not working as expected. could you please share another solution to achieve the requirement or update my shared xml please. Please see the attached screenshot for your reference.
I've selected "Windows" and "NIX" in the multiselect input but only "Windows Request Count" panel is shown however "NIX Request Count" panel should also be shown.

@ITWhisperer 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Your change handler on the multiselect is unsetting all the tokens, it is not setting any of them based on the input selected. This is where you need to have a change handler.

<form version="1.1">
  <label>Multiselect Choice</label>
  <fieldset submitButton="false" autoRun="true">
    <input type="multiselect" token="alloptions" searchWhenChanged="true">
      <label></label>
      <choice value="All">All</choice>
      <choice value="second_choice">second choice</choice>
      <choice value="third_choicee">third choice</choice>
      <choice value="fourth_choice">fourth choice</choice>
      <choice value="fifth_choicee">fifth choice</choice>
      <delimiter>,</delimiter>
      <change>
        <eval token="form.alloptions">case(mvcount('form.alloptions')=0,"All",mvcount('form.alloptions')&gt;1 AND mvfind('form.alloptions',"All")&gt;0,"All",mvcount('form.alloptions')&gt;1 AND mvfind('form.alloptions',"All")=0,mvfilter('form.alloptions'!="All"),1==1,'form.alloptions')</eval>
        <eval token="second">if(isnotnull(mvfind('form.alloptions',"second_choice")) OR isnotnull(mvfind('form.alloptions',"All")),1,null())</eval>
        <eval token="third">if(isnotnull(mvfind('form.alloptions',"third_choice")) OR isnotnull(mvfind('form.alloptions',"All")),1,null())</eval>
        <eval token="fourth">if(isnotnull(mvfind('form.alloptions',"fourth_choice")) OR isnotnull(mvfind('form.alloptions',"All")),1,null())</eval>
        <eval token="fifth">if(isnotnull(mvfind('form.alloptions',"fifth_choice")) OR isnotnull(mvfind('form.alloptions',"All")),1,null())</eval>
      </change>
    </input>
  </fieldset>
  <row>
    <panel depends="$second$">
      <html>
        <p>Second Panel</p>
      </html>
    </panel>
    <panel depends="$third$">
      <html>
        <p>Third Panel</p>
      </html>
    </panel>
    <panel depends="$fourth$">
      <html>
        <p>Fourth Panel</p>
      </html>
    </panel>
    <panel depends="$fifth$">
      <html>
        <p>Fifth Panel</p>
      </html>
    </panel>
  </row>
</form>
0 Karma

mnj1809
Path Finder

This given solution works perfectly. But my requirement is to use value="*" for "All" as I need to use this value in other panels. could you please share the updated dashboard xml having
<choice value="*">All</choice>

@ITWhisperer 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
<form version="1.1">
  <label>Multiselect Choice</label>
  <fieldset submitButton="false" autoRun="true">
    <input type="multiselect" token="alloptions" searchWhenChanged="true">
      <label></label>
      <choice value="*">All</choice>
      <choice value="second_choice">second choice</choice>
      <choice value="third_choice">third choice</choice>
      <choice value="fourth_choice">fourth choice</choice>
      <choice value="fifth_choice">fifth choice</choice>
      <delimiter>,</delimiter>
      <change>
        <eval token="form.alloptions">case(mvcount('form.alloptions')=0,"*",mvcount('form.alloptions')&gt;1 AND mvfind('form.alloptions',"\\*")&gt;0,"*",mvcount('form.alloptions')&gt;1 AND mvfind('form.alloptions',"\\*")=0,mvfilter('form.alloptions'!="*"),1==1,'form.alloptions')</eval>
        <eval token="second">if(isnotnull(mvfind('form.alloptions',"second_choice")) OR isnotnull(mvfind('form.alloptions',"\\*")),1,null())</eval>
        <eval token="third">if(isnotnull(mvfind('form.alloptions',"third_choice")) OR isnotnull(mvfind('form.alloptions',"\\*")),1,null())</eval>
        <eval token="fourth">if(isnotnull(mvfind('form.alloptions',"fourth_choice")) OR isnotnull(mvfind('form.alloptions',"\\*")),1,null())</eval>
        <eval token="fifth">if(isnotnull(mvfind('form.alloptions',"fifth_choice")) OR isnotnull(mvfind('form.alloptions',"\\*")),1,null())</eval>
      </change>
    </input>
  </fieldset>
  <row>
    <panel depends="$second$">
      <html>
        <p>Second Panel</p>
      </html>
    </panel>
    <panel depends="$third$">
      <html>
        <p>Third Panel</p>
      </html>
    </panel>
    <panel depends="$fourth$">
      <html>
        <p>Fourth Panel</p>
      </html>
    </panel>
    <panel depends="$fifth$">
      <html>
        <p>Fifth Panel</p>
      </html>
    </panel>
  </row>
</form>
0 Karma

mnj1809
Path Finder

Thank you so much. Works perfectly !!!
@ITWhisperer 

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...