Hi @davilov, Here's a way I've found to hide/show a panel based on a dropdown. It depends on 3 steps: Define a dropdown with options for each panel you'd like to show/hide, in this example I've called the token "show_panel", and we choose to show/hide two panels or show them all. Set your panel visualisations to hide when there is no data, under the "Visibility" setting:   Update the searches for your visualisations to compare a known string (i.e. the possible token values) to the current token value:   ``` I only want to show this panel if we have selected "Bar Chart" from the drop down:``` | eval _show="Bar Chart" | search _show="$show_panel$" | fields - _show​   You can get a bit fancier by creating chain searches to compare the text so that the search doesn't rerun every time you change the dropdown.   Here's a sample dashboard:   { "visualizations": { "viz_QNQd730H": { "type": "splunk.table", "title": "Table of data", "dataSources": { "primary": "ds_BGrBVi8Q" }, "hideWhenNoData": true }, "viz_JM2qhOeK": { "type": "splunk.bar", "title": "Bar Chart", "dataSources": { "primary": "ds_KD6bNQc9" }, "options": { "xAxisTitleText": "Time", "xAxisLineVisibility": "show", "yAxisTitleText": "Score", "yAxisLineVisibility": "show", "yAxisMajorTickVisibility": "show", "yAxisMinorTickVisibility": "show" }, "hideWhenNoData": true } }, "dataSources": { "ds_BGrBVi8Q": { "type": "ds.search", "options": { "query": "| windbag\n| table source, sample, position\n| eval _show=\"Table\"\n| search _show=\"$show_panel$\"\n| fields - _show" }, "name": "table_search" }, "ds_KD6bNQc9": { "type": "ds.search", "options": { "query": "| gentimes start=-7\n| eval score=random()%500\n| eval _time = starttime\n| timechart avg(score) as score\n| eval _show=\"Bar Chart\"\n| search _show=\"$show_panel$\"\n| fields - _show" }, "name": "barchart" } }, "defaults": { "dataSources": { "ds.search": { "options": { "queryParameters": { "latest": "$global_time.latest$", "earliest": "$global_time.earliest$" } } } } }, "inputs": { "input_global_trp": { "type": "input.timerange", "options": { "token": "global_time", "defaultValue": "-24h@h,now" }, "title": "Global Time Range" }, "input_hs0qamAf": { "options": { "items": [ { "label": "All", "value": "*" }, { "label": "Bar Chart", "value": "Bar Chart" }, { "label": "Table", "value": "Table" } ], "defaultValue": "*", "token": "show_panel" }, "title": "Choose you panel", "type": "input.dropdown" } }, "layout": { "type": "grid", "options": { "width": 1440, "height": 960 }, "structure": [ { "item": "viz_QNQd730H", "type": "block", "position": { "x": 0, "y": 0, "w": 720, "h": 400 } }, { "item": "viz_JM2qhOeK", "type": "block", "position": { "x": 720, "y": 0, "w": 720, "h": 400 } } ], "globalInputs": [ "input_global_trp", "input_hs0qamAf" ] }, "description": "https://community.splunk.com/t5/Dashboards-Visualizations/Conditionally-show-hide-panels-based-on-dropdown-selection-in/m-p/686803#M56222", "title": "Splunk Answers Post" }     ... View more

Your best bet to switch from a chart to a table is to show/hide pre-built panels using tokens.  Tables have different options in the XML code - e.g. column formatting, coloring, drill-downs, highlighting when the mouse hovers. None of these options are relevant for a chart visualization type. The main reason you can't use tokens to change from a chart to a table vis is that the charts use a <chart> tag, while the table vis uses a <table> tag. Simple XML doesn't support using tokens to set XML tags in the dashboard code like that. The cleanest way, in my opinion, is to have hidden panels that you switch between using tokens. ... View more

Hi @GaryZ, As far as I understand, this is not possible with dashboard studio so the best solution would be to have both charts there, but only one displaying depending on the token. However, you can do it with Classic Dashboards (i.e. simple XML dashboards). Here's an example:   <form version="1.1" theme="light"> <label>Splunk answers</label> <fieldset submitButton="false"> <input type="dropdown" token="chart" searchWhenChanged="true"> <label>Chart Style</label> <choice value="line">Line Chart</choice> <choice value="column">Bar Chart</choice> <default>line</default> <initialValue>line</initialValue> </input> </fieldset> <row> <panel> <title>Chart</title> <chart> <search> <query>| gentimes start=-20 | eval sample=random()%100 | eval _time = starttime | timechart span=1d max(sample) as value</query> <earliest>-20d@d</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="charting.chart">$chart$</option> <option name="charting.drilldown">none</option> <option name="refresh.display">progressbar</option> </chart> </panel> </row> </form>   The trick here is to create a token with the value of the chart you'd like to show ("line" or "column") and then use that token in the XML:   <option name="charting.chart">$chart$</option>     This might get annoying to develop though, as you can't edit the chart while this value is set. You can always change it while editing and then change it back when you're done.       ... View more

안녕하세요 릴리, 두 차트는 사용된 시간 범위로 인해 다르게 나타납니다. 첫 번째 차트는 데이터가 있는 경우에만 차트에 선을 표시하는 Splunk 검색에서 가져온 것입니다. 두 번째 차트는 데이터가 없더라도 "전체 기간"에 대한 타임라인을 표시하는 Dashboard Studio의 차트입니다. 차트 2를 차트 1처럼 보이게 하려면 데이터와 일치하도록 시간 범위를 설정하면 됩니다.       데이터와 일치하도록 시간 범위를 설정하면:   (저는 한국어를 잘 못해서 번역기를 사용해야 했어요.) ... View more

@NoIdea, There are different namespaces for tokens - default, submitted, and environment. You're running into the issue because you're using the "default" tokens. These are the ones we normally  use as they are updated on the fly, whereas the submitted tokens are only updated after clicking the submit button. You can refer to these tokens using the namespace followed by a colon, eg: Default: $tok1$ Submitted: $submitted:tok1$ I've tried to understand the values you've put for the tokens and made an alternative dashboard showing the use of submitted tokens: <form version="1.1" theme="light"> <label>answers</label> <fieldset submitButton="true" autoRun="false"> <input type="dropdown" token="tok1" searchWhenChanged="false"> <label>Tok1</label> <choice value="All">*</choice> <choice value="&quot; &quot;AND upper(STATUS)=upper('Active')&quot;">Y</choice> <choice value="&quot; &quot;AND upper(STATUS)=upper('Inactive')&quot;">N</choice> <prefix>Status="</prefix> <default>*</default> </input> <input type="text" token="tok2" searchWhenChanged="false"> <label>UserID</label> <default></default> <prefix> AND UserID=\"*" + upper(</prefix> <suffix>) + "*"</suffix> </input> </fieldset> <row> <panel id="table_1"> <html><h2>Using $$tok1$$</h2><table><tr><td><strong>$$tok1$$=</strong></td><td><textarea>$tok1$</textarea></td></tr><tr><td><strong>$$tok2$$=</strong></td><td><textarea>$tok2$</textarea></td></tr></table> <style>textarea{padding: 4px; font-size:16px;resize:none;width: 300px;border: 1px solid black;} div[id^="table"] td{border:1px solid black;padding: 4px;} div[id^="table"]{width: fit-content; } </style> </html> </panel> </row> <row> <panel id="table_2"> <html><h2>Using $$submitted:tok1$$</h2><table><tr><td><strong>$$submitted:tok1$$=</strong></td><td><textarea>$submitted:tok1$</textarea></td></tr><tr><td><strong>$$submitted:tok2$$=</strong></td><td><textarea>$submitted:tok2$</textarea></td></tr></table></html> </panel> </row> <row> <panel> <html><h2>The Search</h2>| search * $submitted:tok1$ $submitted:tok2$ </html> </panel> </row> </form> By putting your evals and conditionals directly into the values the form should work:   Hopefully that gets you closer to what you're after. There is another way to tackle this - but I don't quite understand your search. It's almost SPL but not quite. If the above isn't what you're after, can you explain your search a bit more? ... View more

I think I understand -  try this search to create a table with fields: _time, percentage and one or more columns based on the value calculated each hour: | gentimes start=-7 | eval sample=random()%100 | eval perc=random()%50 | rename starttime as _time | append[|makeresults | eval sample=100, perc=45| table _time, sample, perc] | timechart span=1d max(sample) as name, avg(perc) as "percentage" ``` Calculate how we name the fields based on the value of: name ``` | eval rename_field_to=if(name=100,"C","N/A") | eval "The Sample Yields {rename_field_to}" = name | fields - rename_field_to, name   This will create three or four columns: _time = time percentage = hourly average of the perc field The Sample Yields C  =  If the max for that hour was 100 The Sample Yields N/A = If the max for that hour was not 100 If you only want "The Sample Yields C" or nothing, then you can filter out with a | search name="C" after the timechart command. The main SPL is :  | eval "The Sample Yields {rename_field_to}" = name That will allow you to name a field using the value of another field.   If you want NA to simply be N/A then you can do a rename: | rename "The Sample Yields N/A" as "N/A" Is that closer to what you were after?       ... View more

Hi @joelsz, Using Splunk 9.1.0 I set up 3 dashboards: dash_a, dash_b, dash_c When you click a button it loads the corresponding dashboard, and that's all.  I've added some starter CSS to pretty up the buttons: <form version="1.1" theme="light"> <label>Dash_C</label> <fieldset submitButton="false"> <input id="linkToOtherDash" type="link" token="link_dash"> <label>View other Dashboard:</label> <choice value="dash_a">Dashboard 1 ↗</choice> <choice value="dash_b">Dashboard 2 ↗</choice> <choice value="dash_c">Dashboard 3 ↗</choice> <change> <condition value="dash_a"> <link target="_blank">/app/search/dash_a</link> </condition> <condition value="dash_b"> <link target="_blank">/app/search/dash_b</link> </condition> <condition value="dash_c"> <link target="_blank">/app/search/dash_c</link> </condition> </change> </input> </fieldset> <row><panel depends="$CSS$"><html><style> .splunk-linklist{ width:fit-content!important; } .splunk-linklist button{ min-width: 120px; } .splunk-linklist button span{ -webkit-box-pack: left; justify-content: left; -webkit-box-align: left; align-items: left; } .splunk-linklist button{ background-color: #dddddd82; margin: 4px 2px 0px 0px; transition: 0.3s; } .splunk-linklist button:hover { background-color: #007abd!important; color: white!important; } </style></html></panel> </row> </form> Note that if you click a button, then go back to the original dashboard and click edit then cancel, it will load the second dashboard again. If you want to avoid that then update the links and remove target="_blank" . ... View more

Hi @deepdive100., You can create the column name based on what the field "name" is set to using by: |makeresults |eval sample="100" |eval name=if(sample=100,"C",N/A) |timechart max(sample) by name This creates a table with columns: _time, C. If the values are less or more than 100, there'll be an additional column "N/A" If you have a dashboard and you want to pick which column is displayed, you could do something like: |makeresults |eval sample="100" |eval name=if(sample=100,"$DROPDOWN_TOKEN$",N/A) |timechart max(sample) by name And set up an input that sets the token $DROPDOWN_TOKEN$.   ... View more

Hi @Hemant93, Masking sensitive data is typically performed on the Heavy Forwarder / Indexer before it goes into the Splunk index. We can do that job with a props.conf file. [maskpii] SEDCMD-pii-dob = s/@dob=['"][^'"]+['"]/@dob='***MASKED***'/g SEDCMD-pii-ssn = s/@ssn=['"][^'"]+['"]/@ssn='***MASKED***'/g This file uses the maskpii sourcetype, and tells Splunk to change any dob or snn value to "***MASKED***". Put that props file on either the heavy forwarder or indexer (wherever your data is sent first) and restart Splunk. Using that file I ingested your sample data and here's the result:     ... View more

Hi @PaulaCom, Here's a way to convert your date to "Jan", "Feb" etc: strftime(date_field, format) see docs We can use the field Order_Date like this: eval month = strftime(strptime(Order_Date, "%d/%m/%Y"), "%b") That adds another step of converting the date to a unix timestamp, then converting that timestamp to the Month in english. Now that we have the month, we can make it a field by using special curly brackets: | eval {month} = Total That will create a field called "Jan" or "Feb" with the value of the total for sales. Here's the Search all together:   |makeresults | eval data="Account_No=\"123\", Total=\"15.00\", Order_Date=\"1/01/2023\"@@Account_No=\"123\", Total=\"35.00\", Order_Date=\"15/02/2023\"@@Account_No=\"123\", Total=\"45.00\", Order_Date=\"19/02/2023\"@@Account_No=\"456\", Total=\"15.00\", Order_Date=\"1/01/2023\"@@Account_No=\"456\", Total=\"50.00\", Order_Date=\"25/01/2023\"@@Account_No=\"456\", Total=\"10.00\", Order_Date=\"19/02/2023\"" | makemv data delim="@@" | mvexpand data | rename data as _raw | extract ``` The above just creates the test data``` | eval month = strftime(strptime(Order_Date, "%d/%m/%Y"), "%b") | stats sum(Total) as Total by Account_No, month | eval {month}=Total | fields - Total, month | stats sum(*) as * by Account_No | table Account_No, Ja*, Fe*,Ma*,Ap*,Ma*,Jun*, Jul*,Au*,Se*,Oc*,No*,De*  The last table bit at the end is so that the months are listed in the right order. The result is: Hopefully that gets you closer to what you were looking for.   Cheers, Daniel ... View more

Hi @anooshac, You were probably really close to the solution for this - but it looks like using tokens to set the colour on tables only works before the table has loaded. The only workaround out I found was to re-run the search each time you select a new radio button. Here's a working version for you to build from. The radio buttons set the type: Both and Type A => Highlight Columns A and B Type B => Highlight Column B The table has a format for ColumnA and ColumnB that looks for the right Type in the token: <format type="color" field="ColumnB"> <colorPalette type="expression">if(match($field_to_highlight|s$,".*TypeB.*"),"#FF0000", "")</colorPalette> </format> To make the dashboard redraw with the right columns highlighted, I added this to the query: ``` $field_to_highlight$ ``` That won't do anything to the search results, but will force the search to be run again. Here is a working dashboard: <form version="1.1" theme="dark"> <label>Answers for anooshac</label> <fieldset submitButton="false"> <input type="radio" token="field_to_highlight" searchWhenChanged="true"> <label>Option</label> <choice value="TypeA__TypeB">Both</choice> <choice value="TypeA_TypeB">Type A</choice> <choice value="TypeB">Type B</choice> <default>TypeATypeB</default> </input> </fieldset> <row> <panel> <table> <title>Content</title> <search> <query>| gentimes start=-20 | eval type=if(random()%2==0,"Type A","Type B") | appendcols[|windbag] | fields starttime, endtime, sample, lang, type | rename starttime as "ColumnA", endtime as "ColumnB" | head 20 ``` $field_to_highlight$```</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> <format type="color" field="ColumnA"> <colorPalette type="expression">if(match($field_to_highlight|s$,".*TypeA.*"),"#FF0000", "")</colorPalette> </format> <format type="color" field="ColumnB"> <colorPalette type="expression">if(match($field_to_highlight|s$,".*TypeB.*"),"#FF0000", "")</colorPalette> </format> </table> </panel> </row> </form>   Hopefully that's close to what you were after. ... View more

Hi @vishalrohila,   You can create dynamic dropdowns by creating searches that populate based on the value of tokens. For example, you can create a dropdown to let users pick either A or W, and that sets a token, $A_or_W$ Then, in the second dropdown you can populate the list based on a lookup, search, or faking the results, and filter out based on what should be shown for A or W. Faking the search to make the options: | makeresults | eval parent="a;w" | makemv parent delim=";" | mvexpand parent | eval options=case(parent="a", "a;b;c", parent="w", "x;y;z") | makemv options delim=";" | mvexpand options | search parent="$A_or_W$" | table options   With that configured, you get a dropdown for A or W selection, which then populates the second dropdown with ABC or XYZ. Your example was fairly generic, so your actual use case might be a better fit for a lookup, with Parent / Label / Value fields. Either way, they list can be filtered by the first lookup. Here's the Dashboard code for you to try out: {"visualizations":{}, "dataSources":{"ds_gKyzOqv5":{"type":"ds.search","options":{"query":"| makeresults\n| eval parent=\"a;w\"\n| makemv parent delim=\";\"\n| mvexpand parent\n| eval options=case(parent=\"a\", \"a;b;c\",parent=\"w\", \"x;y;z\")\n| makemv options delim=\";\"\n| mvexpand options\n| search parent=\"$A_or_W$\"\n| table options"},"name":"dropdown"}}, "defaults":{"dataSources":{"ds.search":{"options":{"queryParameters":{"latest":"$global_time.latest$","earliest":"$global_time.earliest$"}}}}}, "inputs":{"input_global_trp":{"type":"input.timerange","options":{"token":"global_time","defaultValue":"-24h@h,now"},"title":"Global Time Range"},"input_gkLCoAVl":{"options":{"items":[],"token":"dd_7gHCFird","selectFirstSearchResult":true},"title":"Dropdown Input Title","type":"input.dropdown","dataSources":{"primary":"ds_gKyzOqv5"}},"input_VpWiOave":{"options":{"items":[{"label":"All","value":"*"},{"label":"A","value":"a"},{"label":"W","value":"w"}],"token":"A_or_W","defaultValue":"*"},"title":"Choose A or W","type":"input.dropdown"}}, "layout":{"type":"grid","options":{"width":1440,"height":960}, "structure":[],"globalInputs":["input_global_trp","input_VpWiOave","input_gkLCoAVl"]}, "description":"", "title":"test"}   Hopefully that helps. ... View more

Doh! that will teach me for not testing. I'm sure that dashboard worked on an earlier version of Splunk, but you're right, it keeps those pesky commas. Here's an updated version with two key changes:  I've set up the drilldown token to have a value when the dashboard first loads - in case you click the drilldown link before you've changed the dropdown. The regex is fine - but the token seems to be treated like a multivalue field - so I've simply concatenated an empty string to it: $form.multi$ + ""  - this tricks Splunk into treating it like a normal string.    <form version="1.1"> <init> <set token="drilldown">form.multi=val1</set> </init> <label>Send Multi Value Token Drilldown</label> <fieldset submitButton="true" autoRun="false"> <input type="multiselect" token="multi" searchWhenChanged="true"> <label>Multiselect</label> <choice value="val1">key1</choice> <choice value="val2">key2</choice> <choice value="val3">key3</choice> <choice value="val4">key4</choice> <choice value="val5">key5</choice> <default>val1</default> <prefix>(</prefix> <suffix>)</suffix> <initialValue>val1</initialValue> <valuePrefix>"</valuePrefix> <valueSuffix>"</valueSuffix> <delimiter>,</delimiter> <change> <eval token="drilldown">replace($form.multi$ + "","([^,]+),?","&amp;form.multi=$1")</eval> </change> </input> </fieldset> <row> <panel> <title>Token Values</title> <html> <h1>Token: $multi$</h1> <h1>Drildown Token: $drilldown$</h1> <a href="send_multi_value_token_drilldown?$drilldown$" target="_BLANK">Drilldown</a> </html> </panel> </row> </form>   I think that version should work - tested on a Splunk Cloud instance. Cheers, Daniel ... View more

Hi @smanojkumar, Here's a sample dashboard that has a multi-select with prefix/suffix values, and a second token that you can append to drill-downs. Save the dashboard as "send_multi_value_token_drilldown" <form version="1.1"> <label>Send Multi Value Token Drilldown</label> <fieldset submitButton="true" autoRun="false"> <input type="multiselect" token="multi" searchWhenChanged="true"> <label>Multiselect</label> <choice value="val1">key1</choice> <choice value="val2">key2</choice> <choice value="val3">key3</choice> <choice value="val4">key4</choice> <choice value="val5">key5</choice> <default>val1</default> <prefix>(</prefix> <suffix>)</suffix> <initialValue>val1</initialValue> <valuePrefix>"</valuePrefix> <valueSuffix>"</valueSuffix> <delimiter>,</delimiter> <change> <eval token="drilldown">replace('form.multi',"([^,]+),?","&amp;form.multi=$1")</eval> </change> </input> </fieldset> <row> <panel> <title>Token Values</title> <html> <h1>Token: $multi$</h1> <h1>Drildown Token: $drilldown$</h1> <a href="send_multi_value_token_drilldown?$drilldown$" target="_BLANK">Drilldown</a> </html> </panel> </row> </form>   The trick here is in the <change> event on the multiselect. Each time you change the value of the dropdown, it creates a new token with the $form.multi$ token rather than just using $multi$: <eval token="drilldown">replace('form.multi',"([^,]+),?","&amp;form.multi=$1")</eval>   Try changing the values and then click on the "drilldown" link. You will see the same dashboard load in a new window with the same values pre-selected.   On your dashboard, just add the $drilldown$ token to your dashboard, and it will propagate the values. Cheers, Daniel ... View more

Hi @Abass42,   You can achieve this using the foreach command. | makeresults | eval _raw="10/24/2023 06:00:04,source=SXXXX-88880000,destination=10.10.100.130,DuBlIn_,11.11.119.111,port_80=True,port_443=True,port_21=False,port_22=True,port_25=False,port_53=False,port_554=False,port_139=False,port_445=False,port_123=False,port_3389=False" | extract ``` Above is to generate the test data ``` ``` Iterate through each port_xxx field to pick out the open ones ``` | foreach port_* [| eval open_ports=if(<<FIELD>>=="True", mvappend(open_ports, "<<MATCHSTR>>"), open_ports)] | mvexpand open_ports | table _time, destination, gpss_src_ip, open_ports   We use foreach to pick out all the fields that start with port_ and test to see if they are true. If they are, we add the number part of the field name (<<MATCHSTR>>) to a new multivalue field. Then we continue with your mvexpand and table to show the results. The results look like this:   The Splunk Docs page for ForEach explains the use of <<FIELD> and <<MATCHSTR>>   Cheers, Daniel     ... View more

Hi @JWai28 ,   Assuming you have a time dropdown called "global_time" and a drop-down called "dd_span":   With values set up like this (note the '+' next to each value): You could try something like this in your search: index=main [| makeresults | eval earliest_epoch=strptime("$global_time.earliest$", "%Y-%m-%dT%H:%M:%S.%3QZ") | eval earliest_relative=relative_time(now(),"$global_time.earliest$") | eval earliest = coalesce(earliest_epoch, earliest_relative) | eval latest=relative_time(earliest, "$dd_span$") | table earliest_epoch, earliest, latest | return earliest, latest] Breaking this down: This converts the global_time.earliest token into an epoch time (The dashboard either supplies a date string, or something like "-15m" - both cases are catered for). Then it creates the latest token based on the earliest time. Finally, it returns those values to the main search - setting the earliest and latest values.   It's a bit ugly, but should do the job.   Cheers, Daniel ... View more

Hi @lanning_bradley, If you are able to create a React based dashboard, you can us this  https://splunkui.splunk.com/Packages/react-ui/StepBar There's a tutorial to help get you up and running with Splunk UI Toolkit  here: https://splunkui.splunk.com/Create/ComponentTutorial   Cheers, Daniel ... View more