topic Re: Pass tokens from multiselect dropdown to charts in Getting Data In

Pass tokens from multiselect dropdown to charts

anooshac — Thu, 11 Nov 2021 04:34:49 GMT

Hi all,

I have a multiselect dropdown to list all the groups, also i have 2 pie charts for the number of tasks per groups and status of the jobs of tasks.Default selection in the multiselect dropdown is "All". How to pass the tokens from the mutiselect to the charts?

The queries for 2 charts are,

index= "abc" sourcetype="xyz"|chart distinct_count(task) as Tasks by group

The status pie chart is drilldown from the first pie chart. Tok_task is passe as token.

index= "abc" sourcetype="xyz"| search task= $Tok_task$| chart distinct_count(job) as Jobs by status

I just simply passed a token from multiselect to the chart. It is not working as i select multiple options. Does anyone know how to work with this?

Re: Pass tokens from multiselect dropdown to charts

jhanvidattani — Wed, 10 Nov 2021 07:14:17 GMT

@anooshac

Can you refer to below code for the solution:

<form> <label>test</label> <fieldset submitButton="false"> <input type="time" token="time_token"> <label>Time range</label> <default> <earliest>-15m</earliest> <latest>now</latest> </default> </input> <input type="multiselect" token="source_token" searchWhenChanged="true"> <label>Sourcetype</label> <delimiter> OR </delimiter> <fieldForLabel>sourcetype</fieldForLabel> <fieldForValue>sourcetype</fieldForValue> <choice value="*">All</choice> <search> <query>index="_internal" | stats count by sourcetype </query> <earliest>$time_token.earliest$</earliest> <latest>$time_token.latest$</latest> </search> <default>*</default> <initialValue>*</initialValue> <valuePrefix>sourcetype=</valuePrefix> </input> </fieldset> <row> <panel> <table> <title>Associated Source</title> <search> <query>index="_internal" $source_token$ | stats Count by source | rename source as Source</query> <earliest>$time_token.earliest$</earliest> <latest>$time_token.latest$</latest> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> </row> </form>

If you find my solution fruitful, an upvote would be appreciated.

Re: Pass tokens from multiselect dropdown to charts

anooshac — Wed, 10 Nov 2021 07:27:11 GMT

Thanks for replying.. I tried the same and it works only for one input. When i select multiple inputs from the multiselect dropdown the chart shows no results found. Not sure how to solve this.

Re: Pass tokens from multiselect dropdown to charts

jhanvidattani — Wed, 10 Nov 2021 07:30:21 GMT

Can you execute the SPL of the panel so it could be more clear what value is being passed in token or share the XML code over here so we can look into it.

Re: Pass tokens from multiselect dropdown to charts

anooshac — Wed, 10 Nov 2021 09:12:40 GMT

I can't post the actual queries here.. I have changed the parameters. this query below constructs the values for mutliselect dropown.

index= "abc" sourcetype="xyz"|dedup group|table group

The pie chart is constructed using this query.

index= "abc" sourcetype="xyz"|chart distinct_count(task) as Tasks by group

The second pie chart is drilldown from the first pie chart. It is created using this query,"Tok_task" is passed as token from the above pie chart.

index= "abc" sourcetype="xyz"| search task= $Tok_task$| chart distinct_count(job) as Jobs by status

I want to pass tokens from the multiselect dropdown, so that the values selected will be reflected in the pie charts. I used token from the multiselect dropdown directly in the queries but it is not working as i select more values. Still confused on how to proceed with..

Re: Pass tokens from multiselect dropdown to charts

anooshac — Thu, 11 Nov 2021 14:01:54 GMT

Hi all,

I got the solution for this. Added the multiselect token like this in the query.

index= "abc" sourcetype="xyz"|search group IN ($Tok_group$)|chart distinct_count(task) as Tasks by group

index= "abc" sourcetype="xyz"|search group IN ($Tok_group$)| search task= $Tok_task$| chart distinct_count(job) as Jobs by status