topic Re: Why is the table not populating in Dashboards & Visualizations

Why is the table not populating

shrogers — Mon, 12 Feb 2024 15:01:48 GMT

Hello Community,

Any assistance given will be appreciated.

Trying to figure out why my table not populating.

<form version="1.1" theme="dark"> <label>ATM Analyzer</label> <fieldset submitButton="false" autoRun="true"> <input type="dropdown" token="status_token"> <label>Status</label> <fieldForLabel>eventstatus</fieldForLabel> <fieldForValue>eventstatus</fieldForValue> <selectFirstChoice>true</selectFirstChoice> <search> <query>index=atm source="D:\\Program Files\\file.dat" | dedup eventstatus | table eventstatus</query> </search> <default>INFO</default> <initialValue>INFO</initialValue> </input> <input type="dropdown" token="atm_token" searchWhenChanged="false"> <label>ATM</label> <selectFirstChoice>true</selectFirstChoice> <search> <query>index=atm source="D:\\Program Files\\file.dat" | search eventstatus=$status_token$ | dedup atmnumber | table atmnumber</query> </search> <fieldForLabel>atmnumber</fieldForLabel> <fieldForValue>atmnumber</fieldForValue> <choice value="*">All</choice> <default>*</default> <initialValue>*</initialValue> </input> <input type="dropdown" token="event_token"> <label>Event</label> <selectFirstChoice>true</selectFirstChoice> <search> <query>index=atm source="D:\\Program Files\\file.dat" | search (eventstatus=$status_token$ AND atmnumber=$atm_token$) | dedup eventtype | table eventtype</query> </search> <fieldForLabel>eventtype</fieldForLabel> <fieldForValue>eventtype</fieldForValue> <choice value="*">All</choice> <default>*</default> <initialValue>*</initialValue> </input> <input type="time" token="timerange"> <label></label> <default> <earliest>-24h@h</earliest> <latest>now</latest> </default> </input> </fieldset> <row> <panel> <table> <search> <query>index=atm source="D:\\Program Files\\file.dat" where (eventstatus=$status_token$ AND atmnumber="atm_token" AND eventtype=$event_token$) | rename eventtime as Time, eventstatus as Status, atmnumner as ATM, eventtype as Fault, eventdescription as Description | table Time Status ATM Fault Description</query> <earliest>-24h@h</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="count">20</option> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> <option name="percentagesRow">false</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> </table> </panel> </row> </form>

Re: Why is the table not populating

ITWhisperer — Sat, 10 Feb 2024 19:19:00 GMT

It looks like atm_token is not being used as a token in your table search

Re: Why is the table not populating

shrogers — Sat, 10 Feb 2024 19:43:37 GMT

It's being used. highlighted in bold.

<search>
<query>index=atm source="D:\\Program Files\\file.dat" where (eventstatus=$status_token$ AND atmnumber="atm_token" AND eventtype=$event_token$) | rename eventtime as Time, eventstatus as Status, atmnumner as ATM, eventtype as Fault, eventdescription as Description | table Time Status ATM Fault Description</query>

Re: Why is the table not populating

shrogers — Sat, 10 Feb 2024 20:19:29 GMT

Re: Why is the table not populating

ITWhisperer — Sat, 10 Feb 2024 22:40:24 GMT

It is not being used as a token - try atmnumber=$atm_token$

Re: Why is the table not populating

shrogers — Mon, 12 Feb 2024 13:27:38 GMT

Thank you. Issue resolved after using base search. Was able to identified the issue.