Hide Rows or Panels in Splunk Dashboards
By: Yetunde Awojoodu | Splunk Consultant
Imagine a use case requirement to present metrics for multiple application groups in a single Splunk dashboard for the NOC with the different application groups also interested in viewing the same metrics for their hosts. Rather than creating a separate dashboard for each application group in addition to the consolidated one for the NOC, one dashboard could address the requests from all the teams. Note however that in this situation, the data presented in the dashboard can be viewed by all the groups.
These requests can be met by hiding panels or rows in one dashboard. There are perhaps multiple ways to hide panels or rows within a dashboard, but I will be demonstrating how to do so using XML. Your scenario may be quite different from mine but if you need to hide panels or rows, this article should show you how to do so. For simplicity of understanding, my sample data includes only three groups. I have also provided the hypothetical data I used in case you would like to get hands-on in your test lab to understand the way this works. It includes average CPU and memory values for each application group.
I will demonstrate this concept using two scenarios. In the first scenario, the application groups would like to view both CPU and memory data for their groups only and the panels for each group appear on a single row in the dashboard. In the second scenario, the NOC wants to see only panels for memory data for all the groups.
Scenario I – View Only a Selected Row
First, create your dashboard panels, one panel per metric type with a suitable visualization. At this stage, my dashboard looks like this with average CPU and memory for each application group.
Once you have created the panels needed, create an input with a value for each application group. I have selected the dropdown input because it appears to work best when hiding panels or rows due to the setting and unsetting of tokens. My input configuration looks like this:
To hide rows or panels, you will need to include a “change” section in your XML as shown below, making sure to create a token for each group and set or unset tokens based on the panels you would like to see when a particular group is selected. Also remember to include a depends attribute for each row or panel you are referencing. Here is the change section in my dashboard XML:
<change>
<condition label=”All”>
<set token=”CMM_token”>true</set>
<set token=”BBC_token”>true</set>
<set token=”MNS_token”>true</set>
</condition>
<condition label=”CMM”>
<set token=”CMM_token”>true</set>
<unset token=”BBC_token”></unset>
<unset token=”MNS_token”></unset>
</condition>
<condition label=”BBC”>
<set token=”BBC_token”>true</set>
<unset token=”CMM_token”></unset>
<unset token=”MNS_token”></unset>
</condition>
<condition label=”MNS”>
<set token=”MNS_token”>true</set>
<unset token=”CMM_token”></unset>
<unset token=”BBC_token”></unset>
</condition>
</change>
The snapshot below shows a section of my XML including how the depends attribute is specified for each row or panel that may be hidden.
I have selected BBC only in the screenshot below to show you what the dashboard will look like when only one row is selected after configuring hidden rows.
Scenario II – View Only Selected Panels
As in the first scenario, create your panels and configure an input suitable for your use case. I have selected the dropdown input and my configuration looks like this:
In this case, after creating tokens for the values in the change section, the “depends” attribute will be specified with each panel rather than each row as in the first scenario. The CPU_token was created for the CPU panels and MEM_token for memory panels. Below is a snapshot of a section of the XML:
In the screenshot below, I have selected only panels with memory metrics.
In summary, hiding panels or rows in a dashboard can be achieved by simply setting and unsetting tokens and specifying the “depends” attribute in the XML for each panel or row. In my opinion, this method is quite straight forward compared to a few others I have come across.
Have fun Splunking!
Want to learn more about hiding rows or panels in Splunk dashboards? Contact us today!