topic Dropdown missing something in Dashboards & Visualizations

Dropdown missing something

mlevenson — Thu, 08 Mar 2012 02:23:19 GMT

I have a drop down that will let a user select a host in order to view the cpu usage for a particluar time frame, however the search isn't working. I'm poking and proding but can't quite determine what I'm missing.

Here is my config -

<searchTemplate> host=%Server% counter="% Processor Time" | timechart avg(Value) by host</searchTemplate>

  <input type="dropdown" token="Server">
    <choice value="*">Any</choice>
       <populatingSearch fieldForValue="host" fieldForLabel="host">
        <![CDATA[host=%Server% counter="% Processor Time" | timechart avg(Value) by host]]>
       </populatingSearch>
</input>
  <input type="time"/>
  <default>Last 24hrs</default>

The only value that shows up in the dropdown in the word "Any"

Re: Dropdown missing something

Ayn — Thu, 08 Mar 2012 06:28:47 GMT

Why are you using the % character in your populatingSearch? Variable names are referred to by enclosing them in $ characters.

Re: Dropdown missing something

Masa — Thu, 08 Mar 2012 06:37:26 GMT

That search output does not generate host feild. Check the output of the search. Try " stats count by host" and see if you can see a list of host in the dropdown.

Re: Dropdown missing something

mlevenson — Thu, 08 Mar 2012 16:47:28 GMT

<searchTemplate>host=$host$ counter="% Processor Time" | timechart avg(Value) by host</searchTemplate>

    <input type="dropdown" token="host" >
    <label>Select Server</label>
    <choice value="*">Any</choice>
       <populatingSearch fieldForValue="host" fieldForLabel="host">
        <![CDATA[ counter="% Processor Time" | stats count by host]]>
       </populatingSearch>

This ended up working, however it seems the populaing of the dropdown seems to take a while.

Re: Dropdown missing something

Masa — Thu, 08 Mar 2012 18:15:04 GMT

Can you limit the time range for the search?

Re: Dropdown missing something

mlevenson — Thu, 08 Mar 2012 18:21:39 GMT

I use the input type="time" to control what the search range is. Is that what you are refering to?

Re: Dropdown missing something

Masa — Fri, 09 Mar 2012 07:38:07 GMT

earliest=-60m for "60 minutes ago"

( http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/SearchTimeModifiers )