Splunk Child Elements : Set & Unset
SET
We use the set tag to update a token dynamically into the Splunk dashboard.
Format of Set Tag:
<change | drilldown>
<condition> (optional)
<set></set>
</condition> (optional)
</change | /drilldown>
Example:
Here as you can see from lines number 14 to 18 I am using drilldown tag, within that, I am using <set>. Basically here I am setting up a token “sourcetype”, and within that token, I am taking $click.value2$, which is a drilldown token. After that, I am using set token into the panel below at line number 24.
UNSET
Use <unset> to unset or clear set token value. When you unset a token, its value is empty until it is set again.
Format of Unset Tag:
<change | drilldown>
<condition> (optional)
<unset></uset>
</condition> (optional)
</change | /drilldown>
Explanation:
Let’s try to explain how I am using <unset> tokens here. Here from lines number 5 to 26 I have a main table which is showing two fields “sourcetype” and “count”. And then from lines number 14 to 25, I have a drilldown condition. Within that from 15 to 19, I have one condition i.e. if I click on the sourcetype field it will set a token called “showchart” and will unset “showTable”. Now if you see from line number 29 to 38 were in line number 29 it’s dependent on the set token i.e. “showChart”. That means if I click on the sourcetype field then this particular chart will load.
On the other side, on the next drilldown from line number 20 to 24, that is if I click on any field except sourcetype it will set “showTable ” and will unset “showChart”. Now for this next drilldown if you see from line number 39 to 48 wherein line number 39 it’s dependent on “showtable”.
That means if you click on the sourcetype field it will load the chart available in lines number 29 to 38 and will unset the table from lines number 39 to 48. And if you click only other fields except for the sourcetype field then it will load vice versa.
Result:
I hope you all enjoyed this blog “Splunk Child Elements: Set & Unset”, see you all on to the next one.
Must Read:
Splunk Dashboard Child Elements: Eval
Happy Splunking!!
