topic Is it possible to set the sampleRatio for a search using a drop-down token with XML? in Dashboards & Visualizations

Is it possible to set the sampleRatio for a search using a drop-down token with XML?

dbcase — Tue, 11 Oct 2016 15:40:46 GMT

Hi,

I have the below XML code. What I'm trying to do is use a drop-down so the user can select a sampling ratio for the query. Splunk complains with this error message. Is it possible to use a drop-down to set the sampling ratio?

XML Syntax Error: invalid literal for int() with base 10: "'$compare_mso_sample$'"



<input type="dropdown" token="compare_mso_sample" searchWhenChanged="true">
        <label>Select a Sampling Ratio:</label>
        <default>1:100</default>
        <choice value="0">0 - All Events (Computationally HEAVY)</choice>
        <choice value="10">1:10</choice>
        <choice value="25">1:25</choice>
        <choice value="50">1:50</choice>
        <choice value="75">1:75</choice>
        <choice value="100">1:100</choice>
        <choice value="150">1:150</choice>
        <choice value="200">1:200</choice>
        <choice value="300">1:300</choice>
        <choice value="500">1:500</choice>
        <choice value="750">1:750</choice>
        <choice value="1000">1:1000</choice>
        <choice value="5000">1:5000</choice>
      </input>
      <table>
      <title>BEA Codes for $time_field.earliest$</title>

        <search>
          <query>index="$mso_environment$" sourcetype=wls_managedserver | lookup beacodes.csv beacode as bea_code|chart values(desc) as Description sparkline(count(bea_code)) as Trend count(bea_code) as "BEA Code Count" by bea_code|sort -"BEA Code Count"|rename bea_code as "BEA CODE - Click for Detail"</query>
          <earliest>$time_field_mso.earliest$</earliest>
          <latest>$time_field_mso.latest$</latest>
           <sampleRatio>'$compare_mso_sample$'</sampleRatio>

Re: Is it possible to set the sampleRatio for a search using a drop-down token with XML?

somesoni2 — Tue, 11 Oct 2016 19:41:33 GMT

I had similar requirement for setting number of rows displayed in single page of table visualization and couldn't make it work. The reason was that tokens are treated as string (when used in search, splunk does implicit convert to number if required, but that doesn't happen on xml tags) and this property requires an integer value.

Re: Is it possible to set the sampleRatio for a search using a drop-down token with XML?

dbcase — Tue, 11 Oct 2016 20:17:52 GMT

Hi Somesoni2,

Thanks for the reply! I'm guessing that there is no way to convert to an integer or have the original value be an integer?

Re: Is it possible to set the sampleRatio for a search using a drop-down token with XML?

maciep — Tue, 11 Oct 2016 21:39:01 GMT

I was able to do it on 6.5 on my test machine (windows 10). Have you tried removing the single quotes surrounding your token? Not sure why those are there?

Here is what I have:

<form>
  <label>sampling test</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="t_ratio" searchWhenChanged="true">
      <label>Ratio</label>
      <default>100</default>
      <choice value="0">0 - All Events (Computationally HEAVY)</choice>
      <choice value="10">1:10</choice>
      <choice value="25">1:25</choice>
      <choice value="50">1:50</choice>
      <choice value="75">1:75</choice>
      <choice value="100">1:100</choice>
      <choice value="150">1:150</choice>
      <choice value="200">1:200</choice>
      <choice value="300">1:300</choice>
      <choice value="500">1:500</choice>
      <choice value="750">1:750</choice>
      <choice value="1000">1:1000</choice>
      <choice value="5000">1:5000</choice>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>index=wineventlog earliest=@d | table _time, EventCode</query>
          <earliest>$earliest$</earliest>
          <latest>$latest$</latest>
          <sampleRatio>$t_ratio$</sampleRatio>
        </search>
      </table>
    </panel>
  </row>
</form>

Re: Is it possible to set the sampleRatio for a search using a drop-down token with XML?

dbcase — Tue, 11 Oct 2016 21:48:58 GMT

Interesting, must be a 6.5 thing. I'm on 6.4. Time to upgrade!