topic Re: High Refresh is causing Splunk not to assign token correctly in Dashboards & Visualizations

High Refresh is causing Splunk not to assign token correctly

robertlynch2020 — Tue, 11 Jan 2022 16:20:18 GMT

I think I have found a bug in Splunk!!

I have a table like below, I need to click on different columns and for different actions to happen (drill-down).

I have noticed because I have a 5-second refresh rate on the table when a user clicks on the column the tokens get set 80% of the time and the other 20% value of "null" is set. Is there a workaround for this I am on 8.2.0.

When I changed the refresh to 60 seconds it works all the time, when I put it a 1 second, it never works.

robertlynch2020_0-1641917539823.png

The process_serviceName token can get set to the correct value 80% of the time, but "null" can be added to the other 20%.

<eval token="process_serviceName">mvindex(split($row.service_name$," # "),0)</eval>

I have other columns that work fine, but i think as i am doing a calculation on the value this is why it is not working.

<condition match="$click.name2$=="Process_Name" AND ($row.Service_type$=="agent-based" OR $row.Service_type$=="launcher-based")">  <eval token="process_serviceName">mvindex(split($row.service_name$," # "),0)</eval> <set token="pid_clicked">$row.PID$</set> <set token="launcher_name_set_from_process_token">*</set> <unset token="Process_historic_graph"></unset> <unset token="Health_Token"></unset> <unset token="Resources_Token"></unset> <unset token="Java_Token"></unset> </condition>

Re: High Refresh is causing Splunk not to assign token correctly

richgalloway — Tue, 11 Jan 2022 18:29:04 GMT

Rather than find a bug, I think you've made a good case against refreshing dashboards too often. 🙂 It would seem tokens are cleared when the dashboard refreshes and that is why drilldown fails. The less frequently the dashboard refreshes, the lower the chances of failure.

Remember, every time the dashboard refreshes, every search in the dashboard runs again - consuming resources and possibly preventing other searches from running. Ask yourself what information users will get in 5 seconds that they won't get in 30 or 60 seconds and what will they do with that information.

Re: High Refresh is causing Splunk not to assign token correctly

robertlynch2020 — Tue, 11 Jan 2022 18:50:57 GMT

Yes, i agree the 5 seconds is a lot, but businesses are driving that one.

I did find a workaround.

Instead of

<eval token="process_serviceName">mvindex(split($row.service_name$," # "),0)</eval>

I was able to display it directly in the table and set the token, it seems to always work now.

<set token="process_serviceName">$row.service_name$</set>

Thanks for your comments

Re: High Refresh is causing Splunk not to assign token correctly

robertlynch2020 — Tue, 11 Jan 2022 18:51:41 GMT

Yes, i agree the 5 seconds is a lot, but businesses are driving that one.

I did find a workaround.

Instead of

<eval token="process_serviceName">mvindex(split($row.service_name$," # "),0)</eval>

I was able to display it directly in the table and set the token, it seems to always work now.

<set token="process_serviceName">$row.service_name$</set>

Thanks for your comments