topic Re: Splunk Dashboard - 'Waiting for Input' error in Dashboards & Visualizations

Splunk Dashboard - 'Waiting for Input' error

shaquibk — Fri, 23 Jul 2021 17:24:45 GMT

Hi All,

I am stuck with 'Waiting for Input' error for one of the panels that I created in Splunk Dashboard. However, the search runs fine in Search app.

Reading through other similar questions, it seems related to tokens. Tried rectifying it but no good. Following are the search and XML:

Search:

XML:

{

"type": "ds.search",

"options": {

"name": "Search_8"

}

Thanks in advance!

Re: Splunk Dashboard - 'Waiting for Input' error

richgalloway — Fri, 23 Jul 2021 18:36:28 GMT

Does your dashboard source start with <form> or <dashboard>? If the latter, as I suspect, then replace the double $ with single $.

Re: Splunk Dashboard - 'Waiting for Input' error

shaquibk — Fri, 23 Jul 2021 19:19:00 GMT

Hi,

Where do you suggest to check the dashboard source? In the XML code for complete dashboard, I did not find any <form> or <dashboard> tag.

However, there is no form input in my dashboard. Just some panels with some standard searches.

Also, earlier I had put single $ sign and got the same error. But as per Splunk documentation, when using map command, we should user double $$ for variables, hence changed it to double. Anyway, both are giving the same result.

Thanks

Re: Splunk Dashboard - 'Waiting for Input' error

richgalloway — Fri, 23 Jul 2021 20:21:35 GMT

The Simple XML for the dashboard will start with one of those two words. Click Edit->Source to view it. If you have something else then please share.

That you had already tried single $ would have been something good to include in the OP. 😉

Re: Splunk Dashboard - 'Waiting for Input' error

ITWhisperer — Sat, 24 Jul 2021 05:45:29 GMT

As you tag suggests, it looks like you have created the dashboard with Dashboard Studio; this is also evident from what you have called "XML" - this is in fact JSON format definition of part of the dashboard source. Your search requires two tokens to be set (category and number_of_rule). It is these that splunk is waiting for. Where in your dashboard are you setting these? Or are you expecting them to be passed in when the dashboard is launched?

Re: Splunk Dashboard - 'Waiting for Input' error

shaquibk — Mon, 26 Jul 2021 12:14:57 GMT

Hi @ITWhisperer

You are correct about dashboard being created via Dashboard Studio. However, the two tokes (category and number_of_rule) are not to be taken from form input. They are just variables used in the 'Map' command. Hence haven't initialized/set them anywhere separately.

I tried this - https://community.splunk.com/t5/Dashboards-Visualizations/Why-is-the-quot-map-quot-command-not-working-in-dashboard-and/m-p/187296

But having same error.

Re: Splunk Dashboard - 'Waiting for Input' error

shaquibk — Mon, 26 Jul 2021 12:42:31 GMT

Update - Running the same search in classic dashboard works as expected. Used double '$$' sign for variables of the map command.

Issue is specific to dashboard created via Dashboard studio

Re: Splunk Dashboard - 'Waiting for Input' error

richgalloway — Mon, 26 Jul 2021 13:57:57 GMT

It appears to be a known limitation of Dashboard Studio. Per https://docs.splunk.com/Documentation/Splunk/8.2.1/DashStudio/IntroFrame#Compare_classic_Splunk_Dashboards_.28Simple_XML.29_and_the_Splunk_Dashboard_Studio:

If you are using the Splunk Dashboards Studio, tokens can only be generated using inputs. Tokens are not set when a dashboard loads. You cannot set token values as a result of a search.

Re: Splunk Dashboard - 'Waiting for Input' error

ITWhisperer — Mon, 26 Jul 2021 15:15:37 GMT

At the moment, there are a number of limitations with Dashboard Studio that make developing a lot of dashboards untenable and using SimpleXML dashboards is probably the best way for now, imho. Obviously, look out for updates to the Dashboard Studio as these limitations will hopefully eventually be resolved.

Re: Splunk Dashboard - 'Waiting for Input' error

shaquibk — Mon, 26 Jul 2021 15:33:19 GMT

Thanks for the help guys!