topic Re: Query is not fully resolved in dashboard in Dashboards & Visualizations

Query is not fully resolved in dashboard

bowesmana — Fri, 06 Dec 2013 08:15:58 GMT

I have a Simple XML dashboard which does

<form>
  <label>Admin Dashboard</label>
  <description/>
  <fieldset>
    <input type="dropdown" token="company" searchWhenChanged="true">
      <label>Select a Company:</label>
      <default>*</default>
      <choice value="*">All Companies</choice>
      <populatingSearch fieldForValue="Company" fieldForLabel="Co_Name">
        <![CDATA[ | inputlookup rich-co ]]>
      </populatingSearch>
    </input>
    <input type="time" searchWhenChanged="true">
      <label>Select a time</label>
      <default>
        <earliestTime>-7d@w0</earliestTime>
        <latestTime>@w0</latestTime>
      </default>
    </input>
  </fieldset>
  <row>
    <single>
      <searchString>sourcetype=completions_standard Company=$company$ | eval f=if("$company$"=="*","All Companies",Co_Name) | table f</searchString>
      <earliestTime>$earliest$</earliestTime>
      <latestTime>$latest$</latestTime>
    </single>
  </row>
  <row>
    <chart>
      <title>Last week's visitors to the Knowledge Centre</title>
      <searchString>sourcetype="logins_*" Company=$company$ | timechart dc(Username)</searchString>
      <earliestTime>$earliest$</earliestTime>
      <latestTime>$latest$</latestTime>
      <option name="charting.chart">area</option>
      <option name="charting.axisTitleX.visibility">visible</option>
      <option name="charting.axisTitleY.visibility">visible</option>
      <option name="charting.axisX.scale">linear</option>
      <option name="charting.axisY.scale">linear</option>
      <option name="charting.chart.nullValueMode">gaps</option>
      <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
      <option name="charting.chart.stackMode">default</option>
      <option name="charting.chart.style">shiny</option>
      <option name="charting.drilldown">all</option>
      <option name="charting.layout.splitSeries">0</option>
      <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
      <option name="charting.legend.placement">none</option>
      <option name="wrap">true</option>
      <option name="rowNumbers">false</option>
      <option name="dataOverlayMode">none</option>
      <option name="drilldown">cell</option>
      <option name="charting.axisTitleY.text">Users</option>
      <option name="charting.axisLabelsY.majorUnit">10</option>
      <option name="charting.axisTitleX.text">Date</option>
    </chart>
  </row>
</form>

When I open the dashboard, both panels have the text

Search query is not fully resolved

Any idea what's wrong?

Re: Query is not fully resolved in dashboard

somesoni2 — Fri, 06 Dec 2013 14:36:09 GMT

Try changing

Re: Query is not fully resolved in dashboard

bowesmana — Fri, 06 Dec 2013 20:33:16 GMT

No difference.

Re: Query is not fully resolved in dashboard

cschmidt0121 — Fri, 06 Dec 2013 20:55:08 GMT

In Splunk known issues: "eval $foo$ tokens don't work in Simple XML, searches fail with error Search query is not fully resolved. (SPL-74498)"

Looks like it has to do with this?

eval f=if("$company$"=="*","All Companies",Co_Name)

Re: Query is not fully resolved in dashboard

bowesmana — Fri, 06 Dec 2013 21:21:14 GMT

Yes, you're right. I removed the first panel and it still had the problem, so I changed Company=$company$ in the second panel and it fixes the problem. Thanks for that. Not a big deal, just messy.

Re: Query is not fully resolved in dashboard

somesoni2 — Fri, 06 Dec 2013 21:26:43 GMT

Sorry, I overlooked the case.
Try changing

.
in autoRun, "R" is capital and in True, "T" is capital.

I tried the exact same xml of yours and its working fine (its showing no result found as I don't have data, but no error)

Re: Query is not fully resolved in dashboard

bowesmana — Fri, 06 Dec 2013 21:33:49 GMT

Ah, I just flagged cschmidt0121's reply as the answer, but now I changed the autorun to autoRun (capital R) and it works. It doesn't seem to matter about the case of true, both upper and lower case t works.

Re: Query is not fully resolved in dashboard

bowesmana — Fri, 06 Dec 2013 21:35:05 GMT

Not sure if you can have more than one answer, but if you can, please add your post as an answer and I will accept it.

Re: Query is not fully resolved in dashboard

somesoni2 — Fri, 06 Dec 2013 22:45:35 GMT

You can't have more than one answer. just glad things working for you.