Splunk Dashboard : Different kinds Of Event Handling in Splunk Dashboard

okay today we'll be discussing about event handling in Splunk dashboard so if you have seen like normal web pages what happened like people select something from the drop-down right or select the radio button or click on a checkbox right and based on those events like click event or select event right you take some actions right so similar kind of concept exists in Splunk dashboard as well where when you select something from a form input like multi select drop-down right or you select on radio button or you click on a checkbox right based on that you can take certain actions okay and also if you remember sprung dashboards are powered by SPL right such processing language so this plunk has that capability as well like based on certain such phrases like whether the search is in Dunn state or preview state okay in progress state you can take certain actions as well okay so if we divide this whole event handling in Splunk dashboard we can subdivide into four basic parts okay one is the form input level where you select something from the checkbox drop down or click on a link based on that you can take certain actions okay or it could be a search level where you capture basically different states of the search whether it's in either with a failed with it's canceled in progress based on that you can do certain actions or it could be a utilization level itself where you click on a particular visualization which we generally call drill down right so that is also possible the deserves another event in Splunk dashboard as well okay or it could be dashboard page load level that means when you refresh a tag dashboard right at that level also you can take certain actions okay so now based on what kind of even fired it can be again subdivided into certain stuff like form input level when you change something that means you click something or change select something from the drop-down or multi-select rate the change even fire over there okay and now when you capture that even right you can do the conditional capturing as well like which value you have selected like this with it's based on level or not or the value level as well what is the value of that particular selected one or you can capture some kind of match event as well the selected value is matching with something or not based on those conditions you can set a token unset a token you fail it took an evil token is very similar to say token where you can use different kinds of evil expression over there or you can link to another dashboard page as well okay so even there are certain conditions we can capture without these things as well where we really use it for like normal defaulting purpose okay we'll see that one as well today okay similarly for search state level as well you can do the conditional capturing here the condition will be at the search level that means whenever a Splunk search runs right we know it creates a job right so there are certain kind of job properties you can capture in this conditions level and then again it can you can set unset token and evil token as well okay we'll see some of the use cases today okay visualization level it's called drill down and selection right if you remember I already created a video for this one so I will be giving that link as well over here we will not be discussing the visualization level even handling in this particular video okay and there's what page level as I said so when whenever a - put loads you can you can do certain kind of actions over there as well like similar kind of set unset token okay using using unit tag so to demo it what I have done is I actually downloaded a data set called student performance data set okay it's a very simple data set where we have student gender their ethnicity parental level of education okay what medication their parents having but that they have provided the standard or free lunch or reduced lunch whether those students have this preparation scores completed or not based on that they have we have their math score reading score and writing score okay so we will be creating this kind of dashboard today so we will have like five to six drop downs over here based on gender ethnicity parent education lunch this preparation and there is a special drop-down called score graph by so what will happen is in this particular drop down will have both gender ethnicity and on that means the below panels if you see over here so it's basically shows up the math score reading score writing score based on gender based on ethnicity based on both it's a trellis chart okay which will show that one so if I select gender from here only the gender graph will be showing over here nothing else will be shown over over here here we will implement the from input level change event okay and if I just show all it will show all all of these three graphs okay and if you see it each and every graph level also we have certain kind of red here buttons so if I select math if I select just all it will show for all the scores together if I just select math it will only just show the math score okay here also we will see certain kind of Change event implementation okay similarly for this graph as well so the difference between this graph and this graph is here the radio buttons are vertically inclined here it is horizontally inclined we will see how to implement them as well okay and in the last graph where we are basically showing up based on both gender and ethnicity okay so we have a trellis chart so if you do not know about t-shirt one body I would well create a separate video for that trellis is a very special layout ins where if you have multiple stuff in your x-axis right so you can group them like this so if you see my each and every graph have my x-axis as my gender right and then it is creating a separate separate graph for each and every ethnicity okay we will see how to create this villager as well trellis chart as well with simple application today okay so this will be our motor today so let's not waste our time and start developing this dashboard first okay so I have indexed that data in my main index so this is our initial data set okay so I will be going to my dashboard I will create on new dashboard I will give it a name called student performance okay click on create dashboard so first thing we will do is we will just create this for six dropdowns okay so before that what we'll do is we will create a base search so let's good practice to create a be searched in Splunk dashboards so that the results will be cast in the dashboard runs right so this is how we create a base search we have to create a search tag then ID equals two we'll just give it a name called base underscore search okay so the query I will be having is the query tab I will be having this search okay index equals two main and table is okay I just save it and go to edit mode again I click on add input dropdowns okay so level I will give gender okay token I will give gender okay now this particular drop-down will be populated by the gender values okay so what I will do here I'll create it also if you see it over here it has a input call all as well okay it's a value called all as well so that all will be created by a static options okay we'll give you the name all value I'll give star okay and rest of the two options that means male and female will be creating by search okay I will say stats count by so our field name is gender right so I'll copy that one gender okay now default value I will be selecting all okay and anyway this is fill for level will be my gender and feel for value with gender if I apply if you see it will not create anything because stats count by gender does not mean anything on there unless I am referring this particular base search so I will be saying search base equals to my base search okay so if I click on save now so this is ready okay similarly I'll be going over here I'll create another input drop-down so this will be my ethnicity correct level will be fin SAT token will be I just give it small a similar way static options all-star default value is choose all here and my search string will be stats count by race underscore ethnicities or field name right this one so field for level will be this one field for value will be this one apply okay let it be I will just get other inputs then we will add the base search name over there okay so my third dot down is my parent tell location right I will give it a level this one I'll give the token name as parent underscore I do okay so similar way static options all-star default value I choose all till give stats count by so the field name is parental level of education so I will copy that one this one now field for level that were very careful you cannot give within double-quotes okay you have to give within without double quotes otherwise it will take it as a string okay click on apply add input drop down lunch so this is lunch token will be I'll just leave small L over here static option all-star default value I will give all and my search query will be stats count by over fill them called lunch okay lunch fill fall level lunch will for value lunch applying okay let's go to our fifth drop-down test preparation add input drop-down level will be tres preparation I'll give the token name as test underscore PR repeat okay all-star all-star let's count by test preparation of course okay so as as I said fill for label will be without the quotes filled for value will also be without the quotes so you have to remember this one when you have some special character in your face name you have to apply you have to go by this rule okay and my last drop down is score graph by right so I just create the last drop down okay I will give the token as score underscore by right so it will all have static options right so what are the options we have it over here is all both gender and ethnicity right so it will be all by default star add new okay both the value will be both add new gender the value will be gender and ethnicity a th ini see eye to eye okay I think City okay so I'll click on apply okay so and default value for this particular graph will be all as well apply okay so let's go back to our source and let us fix the base search now if you see if you if you query a base search right if you refer if this search you cannot give our DSL it is time at that particular level so you have to remove this one as we'll be running our base search based on all time so I will just add it over here and I'll just give 0 to now okay similarly I'll just copy this base equals to base search okay to all other dropdowns query okay this equals to B search and we'll be removing this understand latest token similarly here as well okay parent education similarly for lunch as well okay similarly for test preparation okay so we done at least our dropdowns already so everything is operating properly okay so let's move on let's create our first panel over here so if you see the initial two panels are mill student count and female student count okay so it's a single value field right so what will happen we'll go to edit well go to add panel I'll click on new panel and I will say single value here single value okay and my okay it's a male student count okay my search string will be so based on this search so what will be if I just wanted to count the number of male student what will happen is I'll search for where my gender equals to mil right and then after that I will say stats stats count right so this will give me the male student count so exactly this search will be adding over there at the panel level is a post process search right so we'll give that one and say add to dashboard okay we'll go to source will again copy this base equals to base search okay and we'll put it over here and we'll remove this one okay so our this panel is also ready now as we had in Splunk 7.2 well I just turn on this dark thing this is a really cool feature in Splunk 7-2 that dashboards looks really good and over here I just format it color number format general and say color and see yes and I'll just do like this okay so similarly for adding a female count right we can just say we are in a single row right so in that particular row itself we'll be adding another panel so I'll just copy this guy this panel level choir code okay and I will paste it over there so I'll just change the code over here female count so gender will be my female right everything else will be same so it should be creating the second thing as well right so let's move on let's first without this particular radio boxes will first implement this one okay that's just the whole part right so what I need to do we need to add another panel with column chart right so I will go to edit add panel new column chart okay my query will be so here my query will be stats as it is average score right average score off math reading and writing right so stats average average is my function and then math score right maths code as if G underscore math underscore score comma average of reading score as AVG under school reading underscore school comma average of writing score as writing underscore score average rating score average writing score now this particular panel is based on gender right so that means it will be by gender okay so this will be my code basically so I'll just add this one at the panel level I will just add it to dashboard and then we'll go to source again to fix the base search so I'll just copy my basic walls to base search so this is my panel right so I will say search there is equals to base search and this particular panel will give it a title called or better we'll do it from the UI itself so here you can give a title or you can give it over here so we'll just copy it from here to save time okay so this my average score by gender remember we still not fix those radio buttons because they're only we'll be discussing all our change events okay so we will just creating our initial dashboard level first then we will talk about other things okay so similarly average score by ethnicity what will happen we will just go to a date source okay it will be another row so I'll just copy this row right I'll paste it over here and I will say average score by sea ethnicity okay so it will be by race underscore ethnicity correct okay and let's save it okay so for the last panel what we'll do it is by basically ethnicity and gender okay here the sale is start coming into picture right so our query will be similar so it will be like average of math score average of reading score average of writing score by gender and ethnicity it will give you this kind of table if I go to visualization okay I will select our normal column chart over here if you have see there is option called Frehley's okay I will turn on the telus over here and I will say split by race and ethnicity so this is how it will generate the trellis chart and then I will say save as my dashboard panel existing dashboard okay I will select my student performance demo okay I will click on save I'll say I lots of you dashboard what I will do and reference this dashboard it should be creating our Seles one now as we as you have seen we have used the full query over there right so we already have a base search for this one if I if I show you the query till this point to this point we already have research we'll be removing this one that one and I will add base equals two research okay and if you see all that Raley's then we have to remove this earliest and latest as well okay if you see all translated things are already configured over here if you do it like this okay otherwise you can do through XML as well it's it's up to you okay so if I just save it so our initial dashboard skeleton is ready okay so now we are moving into okay let let let us keep it in name this one I'll just copy it from here so now the initial requirement will be implementing his core graph by okay that means if I select gender it should only show the gender graph if I select ethnicity it should only show the ethnicity graph if I select both it will only show this trellis graph and if I select all it should show all talking all all of these three graphs okay so for to do that now here we are talking about your selecting something from the drop-down right so let's go back to our edit and source okay so score graph by let us search this one so this is our input total input over here right so score grab by right so now as I as I as you have discussed over here is whenever I am changing something from the form input level the change event fires right so there are corresponding change tag over here okay now inside the change tag we are basically capturing lot of conditions right so now what will be our conditioning dip in this case condition is the tag name okay now inside this condition okay it can it can be either normal condition tag without any condition or it could be a condition as well so now let us see when I will be selecting gender right from our drop-down that means when the value of the selected options will be gender now ever over here if you see we have two things over here in the UI level if I show you the drop-down in the UI level we can see capital G and D right but we have defined the value of this particular thing has gender so either you can you can make a condition with this one or you can make a condition with this one as well now this one is called label and this one is called well this small gender is called value okay so first let us define our condition using label we'll say L a B l equals to capital gender okay so that means when I am selecting gender from my drop-down so this condition is basically telling me that so what I will do I will set a token okay say it token is equals to show gender column chart okay and what I will do is when I will set this token right I'll make my gender graph depends on this token okay so I will copy this token and I'll be going to my gender graph so average score by gender this is my graph right so this particular panel will be dependent on or even you can do it for the whole row itself will depend on that particular token so this is how we can write the depend right within double dollar sign our token name over here okay depends the name is depends so our this one depending on that particular token similarly let us go back again okay so if I select this one this will show up now if I select ethnicity okay this will show up the ethnicity graph so let us build that condition then we'll come back to this condition again to handle something else okay so if my condition now this time we will work with the value so this is how you check the value you value equals to ethnicity okay so I will set another token called thi n I see eye to eye ethnicity column chart okay I will go to my H any city column chart okay this panel or I think this whole rollable depends depends on that particular token right within double dollar that token name let's go back here now let's let's this time use the match we can see it over here either you can do available value or match match means you can match with certain conditions like any value if I say match is the keyword name okay if I say my token name token value is both okay so this is how you access the selected value for a particular input using this temporary token called value okay so this token will hold the value whatever you selected okay similarly for level also there is a token called dollar dollar level you can use that one as well okay I will say this one is double equals to both okay so this time I am taking away the value so I am taking small later both okay okay and now the both is inside double quotes right so this is how you give code over here and % qu would T comma okay so column so this is the one so I'll be sitting up another token called both right and my last panel the trails chart will be dependent on this particular token right so this particular row will be depends on that token correct so our initial setup is done but only one thing we have to remember we have to we have not handled it over here when I will be selecting the gender right I do not want to see other two graphs right so that means I have to unset this particular these two other tokens right so I'll be doing that one here okay so unset token our ethnicity token and unset our both token okay similarly when I will be selecting ethnicity I have to unset my gender and both token right so I will be copying this one and unsetting this so unsaved unset okay so gender token I have unset and also both token we have to unset right similarly for both I have to unset both of this gender and ethnicity so unsetting the gender and unsetting the ethnicity so this is how if you see it over here the change evened I have captured and based on that I have set unset some tokens and I have made my panels based on those tokens so that whatever I am selecting based on that the panel will show and hide let us save it let us see how its behaving okay so okay I think we have not handled for all okay let us do that one so here we have only done for ethnicity gender both for all that means whenever I am selecting all all of these tokens will be sick right because I want to see all of this token so this will be our condition tag without any proper conditions that means this is a default value I will be setting all of these tokens so that all panels will be show up so this is how depends works right so whenever you make a particular panel depends on some token when the token will be set the panel will be showing up okay when the token will be unset the panel will be hidden so select okay so let us refresh the dashboard again okay so by default all panels are showing up so if I select both only my Trail is showing up now whether two are gone right if I select gender so only my gender is showing up other two are gone similar way okay so I can go back to all and all are showing up so this feature we have implemented properly so now let's move on to the panel level where we have to implement this particular radio buttons right so I will go back to our - boot level again I will be clicking on edit okay so what I will do here is first I will just add a radio input okay so then I will go to source and that particular radio input will be cut from here okay and I will now go to my panel level so my first panel is my gender wise right so this is how you add panel level radio buttons you just paste the input over there okay so let's give it a meaningful name for this particular token score gender graph score by okay so now and the level will be our average score of okay or it's a score of a score of math reading writing light so b2b is very specific okay now what we'll do we'll go to you why okay we'll go to that particular pendants so this is that particular radio button is showing up over here but it is a single radio button okay so the first implementation is radio button orientation as vertical level so this is called radio buttons stack okay with a single input we can create all of this radio buttons so what we need to do over here is just add static options over here okay so first options will be all okay the value will be all now the second options will be math reading and writing right math the value will be by math we'll say by all third one will be reading the value will be by reading fourth one will be writing the value will be by writing okay and the default value will be initial value will be all my default value will be all as well okay so if I just apply over here if you see it is vertically aligned right now now the main task begins now whenever I will be selecting Matt it has to only show the average math score not the others okay so for that what we'll do we'll go to our source level okay we will go to that corresponding radio button okay this is how the radio button score radio button code is looks like now we have added a lot of choice right so similarly I'll be handling that change event over here right so whenever I will be selecting some other radio button again the change event will fire over here so again I will be selecting I will be capturing some conditions right condition first condition will be when my value will be by all okay so will here we'll just implement using this value again here also you can use using level match anything okay so here when my value is all right so that means I want all of this average score right so I will set a token token called search string search string okay search string with this particular string that means this one okay so why I am doing this because okay unknown attributes token for the spelling is wrong okay we'll see that one okay so this search thing I will be using in my query so that means we are runtime we are generating the query using a token okay so similarly when I will be selecting the math radio button that means my value will be by math okay so what I need I only need the average math score I do not need the reading score and writing score so I'll be deleting that one so my runtime query will become something like this okay similarly I'll copy this one again when my condition will become that means I will be selecting reading that means value equals to by reading it means this one so what I want I want only the average reading score correct so that is what we will be copying it over here okay by gender similarly for writing as well so value equals two by writing so the time I only need my average writings go okay so my query string is ready so what will happen I will just use this particular token over here so run thing it will generate okay so as a token I have to give it inside dollar dollars okay so looks like it is ready so let us test it out okay we have refreshed so all that means it is showing all of this three writing score reading score and math score right so if I select math now it is see it's only math score is showing up over here if I select reading only reading score writing only writing score okay so this is how it works okay so again using change event using capturing the change event we have implemented this one right similarly we'll be implementing this one as well but this time it will be a horizontally horizontally aligned radio buttons okay so now you will see it difference over here the implementation wise okay so I'll again go to edit okay again I will just capture a radio then I will go to source and I will take that particular radio button code okay so this is our code so again I will go to our ethnicity panel now again I will be pasting it over there so I generally preferred changing from the XML if you are good in the UI level you can you can always go to that level as well but I always try to switch between XML anyway so that it is easier for me okay so this one is showing up now now if you have seen it over here when you are worried we are using a single input with a clustered radio buttons right with the single it would input itself we have handled that one but when you want to make it horizontally you need four inputs over here so that means you need to create four inputs there okay so will be that that is what will be creating it over here so let me show you over there okay so this is our ethnicity panel this is our first input I'll select give this name as Matt okay so the level will be first the one will be all the label will be all okay similarly second input by Matt by reading by writing so this will be Matt okay my token name I can give math only small little Matt and the value will be mad similarly this will be reading right so the value will be okay this beauty and sitting and well while you are creating tokens have to remember that you should not give the same token names otherwise it will behavior will be different and last one is a variety so this will be lighting so all this is the token value and this will be all okay if I just save it you will see now this is horizontally okay so first thing we have to do is over here if you see these things are automatically handle when you select some token right the other token is getting other radio buttons automatically getting this selected right and by default we have given it all right so in the dashboard loads so if I just show you over here right so by by default it is selected as well all because we have given the default value for this particular token as on but here in this case we have to manually handle everything right and as well as the change events as well okay we'll see that one here the change event will be a little bit tricky okay so first thing is we have to handle so if I select all first first of all it is not clickable now so we will just work on this one first the all okay I have my token value is all so this one okay so this is how you will be creating will be will not be giving the label okay will be creating a static option as we have done for this one right all okay and this default value will be all okay an initial value will also be on for this particular token so if I just I play it if you see all it's coming from up top here right so this is the value over here similarly for math as well we'll do the same thing we'll remove the level okay just create aesthetic options math here I will not be selecting as default because by default I want all to be selected okay well click on apply for reading as well name value will be reading click on apply similarly for writing as well give the name value as writing okay now when I will be selecting this token all that means rest of the other tokens will not be selected that means should be dis selected as well okay there is no no such query giving it over here it's fine so in that case what I go I'll go to source level okay I will go to my ethnicity so first two two things we have to do it over here right this is our ethnicity graph and this is our tokens right I think by mistake I clicked on search quality so it was created that one so you have four four inputs over here if you see input one is all math reading and writing right so and the all input change level okay so if I select all that means I want all of this code so as usual when my value will be all okay first thing I will do I'll set it token called search string right this time I'll be sitting search underscore string one I'll just give the token name a search string on okay and the value of this will be all of this score average score by ethnicity corrects as we have done before for gender level okay value unknown attributes well okay change we have to give condition condition value equals two and just this condition tag here okay so for all it is done also when I will be selecting all right so that time I have to unselect the other tokens so here is the trick in in other scenarios in other where we have only one input it was automatically handled but when you are creating multiple inputs that time you have to remember you have to unset something like this unset token is equals to the math right this math token also you have to unsay it form dot math chicken otherwise it will not work okay similarly for writing and reading as well and just copy them and I will unset token reading once a token form not reading on set token writing okay and unset token form not writing okay they have to remember this one similarly when I will be selecting for this particular input when I will be selecting math right so again I have handle the change event over here right you can I have to and add the condition over here right condition will be when my value will be matched right so there I will be setting similar kind of search thing but only with the math score right so that means I do not need these two guys okay similarly I will be unsetting other tokens as well that means unsetting the reading writing and all correct so i will be copying that one twisting that and unsetting the all as well so unset token all and unset token form dot all is a token all and unseat token form dot all okay so this is also done similarly for reading and writing as well so I just do it change condition right so my value will be reading the value will be reading my search string will be only by reading right so I will just copy this one average reading score okay and then we have to unset math all and writing right so unset call on set writing and unset math as well where I have I can copy it from here okay okay so I have ants at all so similarly for writing as well change condition okay so then I'll just similarly my token value will be writing right so that means I am selecting my writing checkbox similarly I will be select setting this search string one token right in this case I will be taking my average writing score correct and I have to unselect all math and reading right so that means unset token all and formed at all okay unset token reading as well so unset token reading okay and unset token math as well I'll just copy it from here okay so let us see now over here I have to use this search string one within double dollar right so let us see okay so I just okay so now if you see if I just select math okay somehow it is not working let's see what's going on over there even reading also let us see get it source just go back to that particular panel okay Matthew D okay I think it is happening because of the default value even though I am selecting other particular at other radio button as this all has a default value of all so it is always getting selected so instead of differe well we just keep the initial value as on okay and I will see that one it is save it let us eat once the default value is gone or not so from here we can also see it the default value is gone okay yeah it was someplace that so it was not able to allowing me to save so now if I if I just click it over here it is showing the score based on ethnicity and math right so if I select all will show for all similarly for reading and writing so you achieve similar kind of behavior but in different way over here and we are also seen in the change event how it is deferred when you have separate separate inputs over here okay similarly you can implement any of this one for other other chart as well so let us not waste our time over there and we will come back to another important stuff called search status okay so now to do that one let us create a use case over here now if you see it over here in the gender right if I just select male or female if I just select male okay so now it has to refresh all the dashboards so to do that what I need to do is you need to basically pass all of these tokens to the base search so that it will be refreshed over here for each and every drop down okay so I just copied from here as it is very simple in nature I'm just passing all the stokin in a search over here okay so you'll save some time over here so if I just save it okay just refresh the - good wounds okay so whatever now you will be selecting from your drop down it will be passed to all of this searches okay and then it will it will show up over there female again or if I select male like this okay to create the with use case what we will do it over here for those two single value will implement in different it's slightly different when I will say stats count by gender okay I'll show you why I am doing this one count it is basically doing the same but were there we are doing first stats then we are filtering with male okay similarly stats count by gender and gender equals to female and table count okay I'll show you why I have done that we create that particular use case so it is it is working the same way because which is it will it would but whenever I will be selecting female now if you see it over here this particular one will show no results found because we are doing the stats first okay then we are filtering out right so if I just run this particular query so what is happening over here is first I am sets counting by gender right then I am doing the male count but as I have my female already filtered it over here right so this particular condition it will fail that means it will make it as no results found now I wanted to hide this particular panel when it is no result found so this will be our use case for search phase condition handling okay so for that what we will do is we'll go to edit this time we'll go to source okay we'll go to our single panel I will be implementing for one panel this is same thing for female panel also we can do that okay so here I have a search right so in the search I can basically query or I can basically handle any of the search state like whether we have seen it over here right whether it's a done state error state failed state so in this case I will be handling the done state when the searches has been completed okay so when the search has been completed okay if this particular search is not giving me any result I'll set it token okay this is how you condition okay see you in DI tion condition okay so this is how you check that particular condition when my result count okay so this is my this is my event name here if you see I am I am not capturing the change event I am capturing that done state over here in this search okay you remember this one the condition again will be same now I'll be matching some condition well same match okay here for a search Splunk search there are lot of job properties which you can check it from this particular link I will be providing this link in my video description as well over there you can see lot of job properties here we'll be using result count okay we'll be using the result count property where it will say total number of result returned by search okay this is how you do it within double one double dollar job okay dot the particular property name okay job dot result count double equals to zero I think this this will be under not under double quotes this is just a property to run a single code no we do not need double dollar over here okay so if this condition is matching okay I will set a token I want to hide this particular panel okay but still I am setting a token if you remember previously when we use the pains right we said a token and when the token is set the panel is getting show up right here also I am setting the token here I wanted to show you hmm another opposite of depend which is called reject okay hide male single value single okay so this particular token if I say it okay now this token this male single count panel it will reject that token rejects that token this is just opposite of depends you can implement two it depends as well but I just wanted to show you how rejects works okay so that means when this token will be set this panel will be hidden okay and the token will be said only when that it is little not show up any result okay and if it is showing any result that means if it is proper then we have to handle the default condition over there okay so will be unset this token that means whenever we unset this token this panel will show up unset okay so you can implement it depends as well but as I wanted to show digit so that's why I have done this one okay so now let us save it okay so now let us refresh our dashboard okay so if I just select female from here so as the male one is returning no result out it is automatically getting getting hidden okay so this is how that works you can the search level tokens token setting also this is how it works okay now the last one I want to discuss it over here is the when the dashboard loads right you can you can set it okay at that time as well so suppose I wanted to when the dashboard loads initially I wanted to set this talk of a person to complete it only that means all the results for this panels this dashboard will be filtered by the completed took a test preparation data itself okay so to do that you can do something like this in the first one you can create a init tag okay and say say it talked N equals two our this token name right the token for test preparation correct to be completed okay the value will be completed Co MP le te d ok so in the dashboard loads it will be set ready to complete it so for that what we will do will just refresh our dashboard did not say it let me see it did so ok you have to use form dot you have to remember this one whenever you you are setting a token which belongs to an input form input ID you have to use form dot that token name ok now it is select now it is actually setting that token so I am refreshing my dashboard and this ticking token is automatically getting set up so all my panels as I am passing this token to my base search right so all my panels will be based on that particular completed result itself so it my this preparation is completed only those rows will be filtered by default ok so this is how different levels of event handling works in Splunk so as I have already discussed visualization they will drill down and selection in little is in any another video so I am NOT I have not discussed this one as well but rest of the stops this is how we how it works and not only the done state of the search right you can you can basically capture any of this particular state of this search and set unset token based on one so in this case you'll remember the only the match option works here we do not have the value and label because this is not and now this is not inform input right and also over here if you see the change event do not fire over here here what it fires is the search different states like done error fall fail cancel something like this okay hopefully this is helpful to you guys see you in next video

Channel: Splunk & Machine Learning

Views: 8,012

Keywords: splunk, how to, event handling, dashboard, trllis, change event, search state event

Id: wQvWEbv1LXg

Length: 66min 54sec (4014 seconds)

Published: Fri Mar 08 2019