Summary Index token drop down help

harkirat9712 — Wed, 30 Sep 2020 03:25:24 GMT

Hi Team,

My current configs has drop down with one token , 3 choice value and 1 search query below.

$api_cached_realtime_token$ is replaced by choice value as per 3 dropdown(All, RealTime, Cached )
Below is original code:

  <input type="dropdown" token="api_cached_realtime_token" searchWhenChanged="true">
    <label>Type</label>
    <choice value="apiActualTimeTaken">All</choice>
    <choice value="realTime_timeTaken">RealTime</choice>
    <choice value="cached_timeTaken">Cached</choice>
    <default>apiActualTimeTaken</default>
    <initialValue>apiActualTimeTaken</initialValue>
  </input>
  <chart>
    <search>
      <query>index=mysupport_core sourcetype=mysupport_app_log event=ApiSummaryEvent api=LinkingToolController.linkProduct  apiStatus=* | timechart span=1h avg($api_cached_realtime_token$) as AVG, P95($api_cached_realtime_token$) as P95</query>
      <earliest>$time_token.earliest$</earliest>
      <latest>$time_token.latest$</latest>
    </search>
    <option name="charting.chart">line</option>
    <option name="charting.drilldown">none</option>
    <option name="refresh.display">progressbar</option>
  </chart>
</panel>

Now I am moving into summary index.

summary_index is = my_summary_index I am writing all the above into summary index by using search query below.

index=mysupport_core sourcetype=mysupport_app_log event=ApiSummaryEvent api=LinkingToolController.linkProduct apiStatus=* | stats avg(apiActualTimeTaken) as AVG_Actual avg(realTime_timeTaken) as AVG_real avg(cached_timeTaken) as AVG_cached P95(apiActualTimeTaken) as P95_Actual P95(realTime_timeTaken) as P95_real P95(cached_timeTaken) as P95_cached

Pls help me achieve same with 3 dropdown (All, RealTime, Cached ) that output search for respective drop-down. (one-token-multiple value-perhaps)
index=my_summary_index | stats sum(AVG_Actual or AVG_real or AVG_cached ) as AVG sum(P95_Actual or P95_real or P95_cached) as per dropdown(All, RealTime, Cached ) respectively.

I tried This article helped a bit but could not achieve yet.

https://answers.splunk.com/answers/525245/how-to-pass-multiple-values-for-a-field-through-to-1.html

Re: Summary Index token drop down help

to4kawa — Sun, 22 Dec 2019 03:03:07 GMT

<form>
  <fieldset submitButton="false">
    <input type="dropdown" token="api_cached_realtime_token" searchWhenChanged="true">
      <label>Type</label>
      <change>
        <eval token="api_test1">mvindex(split($api_cached_realtime_token$,","),0)</eval>
        <eval token="api_test2">mvindex(split($api_cached_realtime_token$,","),1)</eval>
      </change>
      <fieldForLabel>column</fieldForLabel>
      <fieldForValue>value</fieldForValue>
      <search>
        <query>| makeresults
| eval _raw="All,RealTime,Cached
AVG_Actual,AVG_real,AVG_cached
P95_Actual,P95_real,P95_cached"
| multikv forceheader=1
| table All RealTime Cached
| transpose
| eval value=mvzip('row 1','row 2')
| table column value</query>
      </search>
    </input>
  </fieldset>
  <row>
    <panel>
      <html>
        <h1>1: $api_cached_realtime_token$<br/>2: $api_test1$<br/>3: $api_test2$</h1>
      </html>
    </panel>
  </row>

Hi, @harkirat9712
I made the token appropriately, so if you can fix it.

topic Summary Index token drop down help in Dashboards & Visualizations

Summary Index token drop down help

Re: Summary Index token drop down help