topic Re: dropdown and multiselect greyed out in Dashboards & Visualizations

dropdown and multiselect greyed out

sarit_s — Thu, 28 Mar 2019 10:17:16 GMT

hello,
i have a dashboard with multiselect input and dropdown input but for some reason they are both greyed out and the search is not updating after selecting at the first time.
also i have no option to configure default value for both of them

<form>
  <label>List of Pause Events with Times</label>
  <fieldset submitButton="false">
    <input type="multiselect" token="serialnumber" searchWhenChanged="false">
      <label>Serial Number</label>
      <prefix>SerialNumber = </prefix>
      <fieldForLabel>sn</fieldForLabel>
      <fieldForValue>sn</fieldForValue>
      <search>
        <query>index="emea_fdm" | `SerialNumber`</query>
        <earliest>0</earliest>
        <latest></latest>
      </search>
      <delimiter>OR</delimiter>
    </input>
    <input type="dropdown" token="sourcetype" searchWhenChanged="false">
      <label>Source Type</label>
      <prefix>sourcetype = "</prefix>
      <suffix>"</suffix>
      <fieldForLabel>st</fieldForLabel>
      <fieldForValue>st</fieldForValue>
      <search>
        <query>index="emea_fdm" sourcetype="fdm_*_system"</query>
        <earliest>0</earliest>
        <latest></latest>
      </search>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>EMEA</title>
      <table>
        <search ref="List of Pause Events with Times"></search>
        <option name="count">20</option>
        <option name="drilldown">cell</option>
        <drilldown>
          <link target="_blank">/app/St/report?s=SSYS-List%20of%20Pause%20Events%20with%20Times</link>
        </drilldown>
      </table>
    </panel>
  </row>
</form>

Re: dropdown and multiselect greyed out

kamlesh_vaghela — Thu, 28 Mar 2019 10:27:41 GMT

@sarit_s

Can you please confirm your searches are returning results?

index="emea_fdm" | `SerialNumber`


index="emea_fdm" sourcetype="fdm_*_system"

[Updated]

The issue is resolved.

The serialnumber macro was missing. We have updated searches during troubleshooting. All the followed troubleshooting steps are mentioned in the below comments.

Happy Splunking

Re: dropdown and multiselect greyed out

sarit_s — Thu, 28 Mar 2019 11:05:39 GMT

yes they are

Re: dropdown and multiselect greyed out

kamlesh_vaghela — Thu, 28 Mar 2019 12:25:17 GMT

@sarit_s

This is just for troubleshooting:

Can you please try by adding static value in both multiselects?

<choice value="Data1">Value1</choice>

It looks like this:

<fieldset submitButton="false">
    <input type="multiselect" token="serialnumber" searchWhenChanged="false">
      <label>Serial Number</label>
      <prefix>SerialNumber = </prefix>
      <fieldForLabel>sn</fieldForLabel>
      <fieldForValue>sn</fieldForValue>
      <search>
        <query>index="emea_fdm" | `SerialNumber`</query>
        <earliest>0</earliest>
        <latest></latest>
      </search>
      <delimiter>OR</delimiter>
      <choice value="Data1">Value1</choice>
    </input>
    <input type="dropdown" token="sourcetype" searchWhenChanged="false">
      <label>Source Type</label>
      <prefix>sourcetype = "</prefix>
      <suffix>"</suffix>
      <fieldForLabel>st</fieldForLabel>
      <fieldForValue>st</fieldForValue>
      <search>
        <query>index="emea_fdm" sourcetype="fdm_*_system"</query>
        <earliest>0</earliest>
        <latest></latest>
      </search>
      <choice value="Data1">Value1</choice>
    </input>
  </fieldset>

Re: dropdown and multiselect greyed out

sarit_s — Thu, 28 Mar 2019 12:28:31 GMT

its now not grayed out but it canceled the dynamic search

Re: dropdown and multiselect greyed out

kamlesh_vaghela — Thu, 28 Mar 2019 12:35:01 GMT

@sarit_s

Can you please update searches with below and try?

 index="emea_fdm" sn=* | head 10 | `SerialNumber` | table sn


 index="emea_fdm" sourcetype="fdm_*_system" st=* | head 10 | table st

Re: dropdown and multiselect greyed out

sarit_s — Thu, 28 Mar 2019 12:39:15 GMT

Serial Number
Search produced no results.
Source Type

Select...
Could not create search.
Unknown search command 'head10'.

Re: dropdown and multiselect greyed out

kamlesh_vaghela — Thu, 28 Mar 2019 12:45:21 GMT

@sarit_s

Can you please try these searches in search bar?? Make sure the app context would be the same for search bar which your dashboard belongs. I think your searches are not returning results properly or search being failed during execution.

For Source Type search: there is a space between head and 10 like head 10

Re: dropdown and multiselect greyed out

sarit_s — Thu, 28 Mar 2019 12:50:28 GMT

both your searches returning no result but my searches returning results

Re: dropdown and multiselect greyed out

kamlesh_vaghela — Tue, 29 Sep 2020 23:54:05 GMT

@sarit_s

If searches are not returning any events then your events don't have filed sn and st. Can you please check it?

index="emea_fdm" | table time sn _raw
index="emea_fdm" sourcetype="fdm*_system" | table _time st _raw

Please open search bar using below URL.

https://<<SPLUNK>>:8000/en-GB/app/<<MY_APP>>/search

where
<<SPLUNK>> is your Splunk instance
<<MY_APP>> is your app folder name

Re: dropdown and multiselect greyed out

sarit_s — Thu, 28 Mar 2019 13:09:21 GMT

i have field "sourcetype" and field "SerialNumber"
changing Field For Label and Field For Value to be sourcetype and SerialNumber didn't change anything

Re: dropdown and multiselect greyed out

kamlesh_vaghela — Thu, 28 Mar 2019 13:14:05 GMT

@sarit_s

Can you please try below search for second multi-select?

index="" sourcetype="fdm__system" | fields sourcetype

Re: dropdown and multiselect greyed out

sarit_s — Thu, 28 Mar 2019 13:16:38 GMT

does not return anything
but if im changing it to index="" sourcetype="fdm__system" | fields sourcetype it returns results

Re: dropdown and multiselect greyed out

kamlesh_vaghela — Thu, 28 Mar 2019 13:20:13 GMT

@sarit_s

my bad. I forget to press ctrl+K. 🙂 🙂

Try this:

index="*" sourcetype="fdm_*_system" | fields sourcetype

Re: dropdown and multiselect greyed out

sarit_s — Thu, 28 Mar 2019 13:21:27 GMT

i updated my answer , i add * by myself 🙂
with * it returning results

Re: dropdown and multiselect greyed out

kamlesh_vaghela — Thu, 28 Mar 2019 13:27:43 GMT

@sarit_s

So I think the problem is with index name. Can you please check index name by executing below search??

index="*" sourcetype="fdm_*_system" | stats count sourcetype, index

And I think we are populating dropdown. So our searches should be like this.

index="emea_fdm"  | `SerialNumber` | dedup SerialNumber | table SerialNumber


 index="emea_fdm" sourcetype="fdm_*_system" | dedup sourcetype | table

But can you please try below in your dashboard?

index="*"  | `SerialNumber` | dedup SerialNumber | table SerialNumber


 index="*" sourcetype="fdm_*_system" | dedup sourcetype | table

Re: dropdown and multiselect greyed out

sarit_s — Thu, 28 Mar 2019 13:37:15 GMT

ok so this searches fixed the error msg but still if i choose one of the options it does not change the panel results.
actually nothing happens..
also, i want sourcetype dropdown to update automatically after choosing serialnumber and also serialnumber to update automatically after choosing sorucetype.
is it possible ?

Re: dropdown and multiselect greyed out

kamlesh_vaghela — Thu, 28 Mar 2019 13:42:58 GMT

ooh..

So you need to create a token which can be used in another search. For that, you have to add <change> tag in select input.

Please check below link for same:

https://docs.splunk.com/Documentation/Splunk/7.2.5/Viz/PanelreferenceforSimplifiedXML#change_.28form_input.29

Re: dropdown and multiselect greyed out

sarit_s — Tue, 29 Sep 2020 23:50:53 GMT

hi.
i think that something basic in missing since im getting very weird error msg
"Error in 'table' command: Invalid argument: '-'
i have no idea what this error is about since i don't have this argument in my search

List of Pause Events with Times

Serial Number
SerialNumber =
sn
SerialNumber

index="emea_fdm" | rex field=source \/ssyssplunk\/\w+\/\w+\/\w+\/\w+\/(?<SerialNumber>\w+) | dedup SerialNumber |table SerialNumber
0

Source Type
sourcetype =
st
sourcetype

index="emea_fdm" sourcetype="fdm__system" |dedup sourcetype |table sourcetype
0

<choice value="">ALL
*

EMEA

index="emea_fdm" pauseReason: NOT "pauseReason: NotPaused" pauseReason: NOT "pauseReason: UserPaused" |rex field=source \/ssyssplunk\/\w+\/\w+\/\w+\/\w+\/(?<SerialNumber>\w+)|rex "pauseReason:\s+(?<pause_reason>\w+)"| table _time pause_reason $SerialNumber$ $sourcetype$ source
0

none

Re: dropdown and multiselect greyed out

sarit_s — Mon, 01 Apr 2019 07:09:22 GMT

also, i saw this :

Note: The element is not
available for multiselect inputs.

so , if i want to use multiselect, how can i do it ?