topic Re: Help with an issue in a drilldown token from a dropdown list in Dashboards & Visualizations

Help with an issue in a drilldown token from a dropdown list

jip31 — Thu, 13 Jun 2019 06:28:56 GMT

In my dashboard, I use the search below
This search is updated from a dropdown list token (tok_filtersite)

[| inputlookup host.csv 
    | table host] index="x" sourcetype="perfmonmk:process" 
| bucket _time span=3m 
| where process_cpu_used_percent>80 
| lookup lookup_cmdb_fo_all.csv HOSTNAME as host output SITE 
**| search SITE=$tok_filtersite|s$** 
| stats dc(process_name) as Total by host 
| sort -Total limit=10

This token is also used in the drilldown associated to my search (where SITE=$SITE$)

[| inputlookup host.csv 
    | table host] index="x" sourcetype="perfmonmk:process" 
| bucket _time span=3m 
| where process_cpu_used_percent>80 
| dedup host process_name 
| lookup lookup_cmdb_fo_all.csv HOSTNAME as host output SITE COUNTRY TOWN ROOM 
**| where SITE=$SITE$** 
| eval time = strftime(_time, "%m/%d/%Y %H:%M") 
| eval process_cpu_used_percent=round(process_cpu_used_percent,2). " %" 
| stats latest(time) as time, values(COUNTRY) as COUNTRY, values(TOWN) as TOWN, values(SITE) as SITE, values(ROOM) as ROOM, latest(process_cpu_used_percent) as process_cpu_used_percent by host process_name 
| sort -Total 
| table time host COUNTRY TOWN SITE ROOM process_cpu_used_percent 
| sort -Total

It works perfectly except when I choose * in my dropdown list
If I choose *, the data are well updated in the main dashboard but when I click on my report in order to open the drilldown, this one is empty
What I have to do to display data in my drilldown when I choose * in my dropdown list please??
thanks in advance

Re: Help with an issue in a drilldown token from a dropdown list

DavidHourani — Thu, 13 Jun 2019 06:48:46 GMT

Any chance we can get the xml ?

Re: Help with an issue in a drilldown token from a dropdown list

jip31 — Thu, 13 Jun 2019 06:56:28 GMT

here is
https://www.cjoint.com/c/IFng3GNCDpb

Re: Help with an issue in a drilldown token from a dropdown list

jip31 — Thu, 13 Jun 2019 14:09:34 GMT

could it have helped?

Re: Help with an issue in a drilldown token from a dropdown list

DavidHourani — Mon, 17 Jun 2019 06:50:43 GMT

hey @jip31, from what I understand the second search is not giving you any results when you use something other than * , is that right ?
Have you tried adding quotes for the token SITE="$SITE$" or escaping it in case there are special characters SITE="$SITE|s$"

Re: Help with an issue in a drilldown token from a dropdown list

jip31 — Mon, 17 Jun 2019 08:30:33 GMT

hey, yes its right
when i m doing SITE="$SITE$", i have an issue :
"error in where command typechecking failed "" only takes numbers"
and when I m doing SITE="$SITE|s$"
I have another issue
"error in where command the operator at '\"\""' is invalid"

Re: Help with an issue in a drilldown token from a dropdown list

DavidHourani — Mon, 17 Jun 2019 08:35:08 GMT

how about replacing :

| where SITE=$SITE$

with this :

| search SITE="$SITE$"

Re: Help with an issue in a drilldown token from a dropdown list

jip31 — Tue, 18 Jun 2019 06:14:16 GMT

Unfortunately no!
I have tested | search SITE="$SITE$" and | search SITE="$SITE|s$" and it doesn't works....

Re: Help with an issue in a drilldown token from a dropdown list

jip31 — Tue, 18 Jun 2019 07:14:29 GMT

and if I do | search SITE=Toul* in the drilldown it works

Re: Help with an issue in a drilldown token from a dropdown list

DavidHourani — Tue, 18 Jun 2019 08:21:03 GMT

So let's see what's inside the "$SITE$", can you add $SITE$ to the title of the view ? Should show you the result it's giving on the title line 🙂

Re: Help with an issue in a drilldown token from a dropdown list

DavidHourani — Tue, 18 Jun 2019 09:23:41 GMT

@jip31, let me know what you see for your token value

Re: Help with an issue in a drilldown token from a dropdown list

jip31 — Tue, 18 Jun 2019 15:00:49 GMT

hey, I just see $SITE$ ....

Re: Help with an issue in a drilldown token from a dropdown list

DavidHourani — Tue, 18 Jun 2019 15:12:01 GMT

Then run it as the search : | makeresults | eval msg=$SITE$

Re: Help with an issue in a drilldown token from a dropdown list

jip31 — Wed, 19 Jun 2019 15:53:39 GMT

it's strange, I have the field _time dispalyed!!

Re: Help with an issue in a drilldown token from a dropdown list

DavidHourani — Wed, 19 Jun 2019 16:08:18 GMT

so this is your problem 😄 change the token name in the input and try using that, maybe you got two tokens mixed up. And make sure you have |fields yourSiteFieldName populating the value and not just a search.

Re: Help with an issue in a drilldown token from a dropdown list

jip31 — Thu, 20 Jun 2019 06:59:54 GMT

You mean something like this :
SITE=$TOTO$ | fields TOTO ??