topic How to pass multiple values for a field through token in a dashboard? in Dashboards & Visualizations

How to pass multiple values for a field through token in a dashboard?

Soundaryakunder — Fri, 01 Jul 2022 07:52:26 GMT

Dashboard is taking a long time to load and it has 17 apps in one panel. I have also tried creating a token such as <set token="app_names">app1,app2</set> instead of using wildcard. but query is not returning any result.

Code snippet

<init> <set token="app_names">app1,app2,app3................</set> </init> ...... <row> <panel> <title>Dashboard</title> <table> <search> <query>index=idx ns=xyz* app_name=$app_names$ pod_container=xyz* ((" ERROR " OR " WARN ") |stats count by app_name | append [| stats count | eval app_name="app1,app2,app3........" | table app_name | makemv app_name delim="," | mvexpand app_name] .......

Please advise!

Re: How to pass multiple values for a field through token in a dashboard?

ITWhisperer — Fri, 01 Jul 2022 08:07:27 GMT

Would something like this help?

index=idx ns=xyz* app_name IN ($app_names$) ...

Re: How to pass multiple values for a field through token in a dashboard?

Soundaryakunder — Fri, 01 Jul 2022 08:35:23 GMT

Your solution really helped. Thank you very much

Dashboard is taking a long time to load. How to improve the performance?

Soundaryakunder — Mon, 04 Jul 2022 10:38:07 GMT

I have created a dashboard with 3 panels and it has 17 apps.

Please help me on this.

Re: Dashboard is taking a long time to load. How to improve the performance?

ITWhisperer — Mon, 04 Jul 2022 10:43:53 GMT

It depends on what you are trying to display in your dashboard - if you have 17 searches to do, this will take some time - there are various optimisations available but it depends on your use case - things to consider are summary indexes, saved reports, splitting across multiple dashboards, hiding panels until data is available, etc.

Re: Dashboard is taking a long time to load. How to improve the performance?

Soundaryakunder — Mon, 04 Jul 2022 10:53:45 GMT

Okay. Thanks

Re: Dashboard is taking a long time to load. How to improve the performance?

Soundaryakunder — Tue, 05 Jul 2022 04:27:07 GMT

I need one more help..

I have already specified the multiple values(app1,app2,app3.....)in the token. So I have tried to remove the eval(eval app_name="app1,app2,app3........") command from the Query. but it is returning wrong results. Is this eval command is required?

Please suggest me on this.

<init> <set token="app_names">app1,app2,app3................</set> </init> ...... <row> <panel> <title>Dashboard</title> <table> <search> <query>index=idx ns=xyz* app_name IN ($app_names$) pod_container=xyz* ((" ERROR " OR " WARN ") |stats count by app_name | append [| stats count | eval app_name="app1,app2,app3........" | table app_name | makemv app_name delim="," | mvexpand app_name] .......

Thanks.