topic Re: Invalid value Drilldown error in Splunk Search

Invalid value Drilldown error

ssingh313 — Wed, 03 Aug 2016 15:25:22 GMT

I have a table on my dashboard which contains values that link to the actual data log on splunk. I am trying to open the data logs within the dashboard and I am using the drilldown code below but I keep on getting an "Invalid value "1468323531.846-1" for time term 'earliest' " error. Below is the code I'm using. Anyone know how I can fix this?

            <drilldown>
              <set token="tok_ShowEvents">true</set>
              <set token="e">$click.value$-1</set>
              <set token="l">$click.value$+1</set>
              <set token="AttributeConnID">$row.AttributeConnID$</set>
              <set token="AttributeANI">$row.AttributeANI$</set>
              <set token="AttributeCallType">$row.AttributeCallType$</set>
              <set token="AttributeDNIS">$row.AttributeDNIS$</set>
              <set token="AttributeCallUUID">$row.AttributeCallUUID$</set>
            </drilldown>
            <option name="wrap">undefined</option>
            <option name="rowNumbers">undefined</option>
            <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
            <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
            <option name="charting.axisTitleX.visibility">visible</option>
            <option name="charting.axisTitleY.visibility">visible</option>
            <option name="charting.axisTitleY2.visibility">visible</option>
            <option name="charting.axisX.scale">linear</option>
            <option name="charting.axisY.scale">linear</option>
            <option name="charting.axisY2.enabled">0</option>
            <option name="charting.axisY2.scale">inherit</option>
            <option name="charting.chart">bubble</option>
            <option name="charting.chart.bubbleMaximumSize">50</option>
            <option name="charting.chart.bubbleMinimumSize">10</option>
            <option name="charting.chart.bubbleSizeBy">area</option>
            <option name="charting.chart.nullValueMode">gaps</option>
            <option name="charting.chart.showDataLabels">none</option>
            <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
            <option name="charting.chart.stackMode">default</option>
            <option name="charting.chart.style">shiny</option>
            <option name="charting.drilldown">all</option>
            <option name="charting.layout.splitSeries">0</option>
            <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
            <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
            <option name="charting.legend.placement">right</option>
            <option name="dataOverlayMode">none</option>
            <option name="drilldown">row</option>
            <option name="count">10</option>
          </table>
        </panel>
      </row>
      <row>
        <panel depends="$tok_ShowEvents$">
          <event>
            <search>
              <query> index=windoesapps sourcetype=Genesys_AvayaTserver earliest=$e$ latest=$l$ | eval x="$tok_ShowEvents$" | rex "(Trc|Adjusted|distribute_event|distribute_user_event|send_to_client|distribute_response):?\s\w+\s(?&lt;EventName&gt;\w+)"| rex "AttributeConnID'?\s'?(?&lt;AttributeConnID&gt;[^\t\n\r]+)"| rex "AttributeANI'?\s'?(?&lt;AttributeANI&gt;[^\t\n\r]+)"| rex "AttributeDNIS'?\s'?(?&lt;AttributeDNIS&gt;[^\t\n]+)"| rex "AttributeCallType'?\s'?(?&lt;AttributeCallType&gt;[^\t\n]+)"| rex "AttributeCallUUID'?\s'?(?&lt;AttributeCallUUID&gt;[^\t\n]+)"| rex "AttributeUserData'?\s'?(?&lt;AttributeUserData&gt;[^\t\n]+)" </query>
              <earliest></earliest>
              <latest></latest>
            </search>
          </event>
        </panel>
      </row> 
    </form>

Re: Invalid value Drilldown error

sundareshr — Wed, 03 Aug 2016 15:35:47 GMT

Try this

             <drilldown>
               <set token="tok_ShowEvents">true</set>
               <eval token="e">relative_time($click.value$, "-1s")</eval>
               <eval token="l">relavitve_time($click.value$, "+1s")</eval>
               <set token="AttributeConnID">$row.AttributeConnID$</set>
               <set token="AttributeANI">$row.AttributeANI$</set>
               <set token="AttributeCallType">$row.AttributeCallType$</set>
               <set token="AttributeDNIS">$row.AttributeDNIS$</set>
               <set token="AttributeCallUUID">$row.AttributeCallUUID$</set>
             </drilldown>
             <option name="wrap">undefined</option>
             <option name="rowNumbers">undefined</option>
             <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
             <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
             <option name="charting.axisTitleX.visibility">visible</option>
             <option name="charting.axisTitleY.visibility">visible</option>
             <option name="charting.axisTitleY2.visibility">visible</option>
             <option name="charting.axisX.scale">linear</option>
             <option name="charting.axisY.scale">linear</option>
             <option name="charting.axisY2.enabled">0</option>
             <option name="charting.axisY2.scale">inherit</option>
             <option name="charting.chart">bubble</option>
             <option name="charting.chart.bubbleMaximumSize">50</option>
             <option name="charting.chart.bubbleMinimumSize">10</option>
             <option name="charting.chart.bubbleSizeBy">area</option>
             <option name="charting.chart.nullValueMode">gaps</option>
             <option name="charting.chart.showDataLabels">none</option>
             <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
             <option name="charting.chart.stackMode">default</option>
             <option name="charting.chart.style">shiny</option>
             <option name="charting.drilldown">all</option>
             <option name="charting.layout.splitSeries">0</option>
             <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
             <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
             <option name="charting.legend.placement">right</option>
             <option name="dataOverlayMode">none</option>
             <option name="drilldown">row</option>
             <option name="count">10</option>
           </table>
         </panel>
       </row>
       <row>
         <panel depends="$tok_ShowEvents$">
           <event>
             <search>
               <query> index=windoesapps sourcetype=Genesys_AvayaTserver earliest=$e$ latest=$l$ | eval x="$tok_ShowEvents$" | rex "(Trc|Adjusted|distribute_event|distribute_user_event|send_to_client|distribute_response):?\s\w+\s(?<EventName>\w+)"| rex "AttributeConnID'?\s'?(?<AttributeConnID>[^\t\n\r]+)"| rex "AttributeANI'?\s'?(?<AttributeANI>[^\t\n\r]+)"| rex "AttributeDNIS'?\s'?(?<AttributeDNIS>[^\t\n]+)"| rex "AttributeCallType'?\s'?(?<AttributeCallType>[^\t\n]+)"| rex "AttributeCallUUID'?\s'?(?<AttributeCallUUID>[^\t\n]+)"| rex "AttributeUserData'?\s'?(?<AttributeUserData>[^\t\n]+)" </query>
               <earliest></earliest>
               <latest></latest>
             </search>
           </event>
         </panel>
       </row> 
     </form>

Re: Invalid value Drilldown error

ssingh313 — Wed, 03 Aug 2016 15:44:54 GMT

this is still giving me the same error Invalid value "1468323531.847-1" for time term 'earliest'

Re: Invalid value Drilldown error

ssingh313 — Wed, 03 Aug 2016 21:49:44 GMT

If there us another way let me know

Re: Invalid value Drilldown error

sundareshr — Wed, 03 Aug 2016 22:14:28 GMT

Do you have any other place where you're doing a $earliest$-1? It appears the change did not take effect.

Re: Invalid value Drilldown error

ssingh313 — Wed, 03 Aug 2016 23:06:38 GMT

I have earliest and latest as part of another query within the code.

Re: Invalid value Drilldown error

sundareshr — Wed, 03 Aug 2016 23:09:41 GMT

are you subtracting 1 from earliest and/or latest in that query? Try removing the two eval elements from your code and see if the error goes away.

Re: Invalid value Drilldown error

ssingh313 — Wed, 03 Aug 2016 23:58:02 GMT

This is what my entire code looks like right now. I tried removing the eval elements and it gives me a search is waiting for input error.

<form>
  <label>Genesys Search Test</label>
  <fieldset submitButton="false" autoRun="true">
    <input type="text" token="tok_ID" searchWhenChanged="true">
      <label>ConnID/CallUUID</label>
      <default></default>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>Genesys Server</title>
      <table>
        <title>Avaya Tserver</title>
        <search>
          <query>index=windowsapps sourcetype=Genesys_AvayaTserver "$tok_ID$" | rex"(Trc|Adjusted|distribute_event|distribute_user_event|send_to_client|distribute_response):?\s\w+\s(?&lt;EventName&gt;\w+)"| rex"AttributeConnID'?\s'?(?&lt;AttributeConnID&gt;[^\t\n\r]+)"| rex"AttributeANI'?\s'?(?&lt;AttributeANI&gt;[^\t\n\r]+)"| rex"AttributeDNIS'?\s'?(?&lt;AttributeDNIS&gt;[^\t\n]+)"| rex"AttributeCallType'?\s'?(?&lt;AttributeCallType&gt;[^\t\n]+)"|rex"AttributeCallUUID'?\s'?(?&lt;AttributeCallUUID&gt;[^\t\n]+)"|rex"AttributeUserData'?\s'?(?&lt;AttributeUserData&gt;[^\t\n]+)"|table_time EventName AttributeConnID AttributeANI AttributeDNIS AttributeCallType AttributeCallUUID AttributeUserData| where isnotnull(AttributeANI)</query>
          <earliest>-30d@d</earliest>
          <latest>now</latest>
        </search>
        <drilldown>
          <set token="tok_ShowEvents">true</set>
          <set token="AttributeConnID">$row.AttributeConnID$</set>
          <set token="AttributeANI">$row.AttributeANI$</set>
          <set token="AttributeCallType">$row.AttributeCallType$</set>
          <set token="AttributeDNIS">$row.AttributeDNIS$</set>
          <set token="AttributeCallUUID">$row.AttributeCallUUID$</set>
        </drilldown>
        <option name="wrap">undefined</option>
        <option name="rowNumbers">undefined</option>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">bubble</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">right</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">row</option>
        <option name="count">10</option>
      </table>
    </panel>
  </row>
  <row>
    <panel depends="$tok_ShowEvents$">
      <event>
        <search>
          <query>index=windowsapps sourcetype=Genesys_AvayaTserver earliest=$e$ latest=$l$ | rex "(Trc|Adjusted|distribute_event|distribute_user_event|send_to_client|distribute_response):?\s\w+\s(?&lt;EventName&gt;\w+)"| rex "AttributeConnID'?\s'?(?&lt;AttributeConnID&gt;[^\t\n\r]+)"| rex "AttributeANI'?\s'?(?&lt;AttributeANI&gt;[^\t\n\r]+)"| rex "AttributeDNIS'?\s'?(?&lt;AttributeDNIS&gt;[^\t\n]+)"| rex "AttributeCallType'?\s'?(?&lt;AttributeCallType&gt;[^\t\n]+)"| rex "AttributeCallUUID'?\s'?(?&lt;AttributeCallUUID&gt;[^\t\n]+)"| rex "AttributeUserData'?\s'?(?&lt;AttributeUserData&gt;[^\t\n]+)"</query>
          <earliest></earliest>
          <latest></latest>
        </search>
      </event>
    </panel>
  </row>
</form>

Re: Invalid value Drilldown error

somesoni2 — Thu, 04 Aug 2016 00:41:05 GMT

Give this a try for your first table's drilldown

 <drilldown>
                  <condition>
                   <set token="tok_ShowEvents">true</set>
                   <eval token="e">$click.value$-1</eval >
                   <eval token="l">$click.value$+1</eval >
                   <set token="AttributeConnID">$row.AttributeConnID$</set>
                   <set token="AttributeANI">$row.AttributeANI$</set>
                   <set token="AttributeCallType">$row.AttributeCallType$</set>
                   <set token="AttributeDNIS">$row.AttributeDNIS$</set>
                   <set token="AttributeCallUUID">$row.AttributeCallUUID$</set>
         </condition>
</drilldown>

Re: Invalid value Drilldown error

ssingh313 — Thu, 04 Aug 2016 01:10:07 GMT

do I add this to the code or change the drilldown code that I have?

Re: Invalid value Drilldown error

somesoni2 — Thu, 04 Aug 2016 01:30:35 GMT

Replace yours with this one (for drilldown only)

Re: Invalid value Drilldown error

ssingh313 — Thu, 04 Aug 2016 01:40:48 GMT

It gives me a "Search is waiting for input" error message.

Re: Invalid value Drilldown error

somesoni2 — Thu, 04 Aug 2016 02:08:40 GMT

Just to be sure, your code looks like this now?

<form>
   <label>Genesys Search Test</label>
   <fieldset submitButton="false" autoRun="true">
     <input type="text" token="tok_ID" searchWhenChanged="true">
       <label>ConnID/CallUUID</label>
       <default></default>
     </input>
   </fieldset>
   <row>
     <panel>
       <title>Genesys Server</title>
       <table>
         <title>Avaya Tserver</title>
         <search>
           <query>index=windowsapps sourcetype=Genesys_AvayaTserver "$tok_ID$" | rex"(Trc|Adjusted|distribute_event|distribute_user_event|send_to_client|distribute_response):?\s\w+\s(?&lt;EventName&gt;\w+)"| rex"AttributeConnID'?\s'?(?&lt;AttributeConnID&gt;[^\t\n\r]+)"| rex"AttributeANI'?\s'?(?&lt;AttributeANI&gt;[^\t\n\r]+)"| rex"AttributeDNIS'?\s'?(?&lt;AttributeDNIS&gt;[^\t\n]+)"| rex"AttributeCallType'?\s'?(?&lt;AttributeCallType&gt;[^\t\n]+)"|rex"AttributeCallUUID'?\s'?(?&lt;AttributeCallUUID&gt;[^\t\n]+)"|rex"AttributeUserData'?\s'?(?&lt;AttributeUserData&gt;[^\t\n]+)"|table_time EventName AttributeConnID AttributeANI AttributeDNIS AttributeCallType AttributeCallUUID AttributeUserData| where isnotnull(AttributeANI)</query>
           <earliest>-30d@d</earliest>
           <latest>now</latest>
         </search>
        <drilldown>
                   <condition>
                    <set token="tok_ShowEvents">true</set>
                    <eval token="e">$click.value$-1</eval >
                    <eval token="l">$click.value$+1</eval >
                    <set token="AttributeConnID">$row.AttributeConnID$</set>
                    <set token="AttributeANI">$row.AttributeANI$</set>
                    <set token="AttributeCallType">$row.AttributeCallType$</set>
                    <set token="AttributeDNIS">$row.AttributeDNIS$</set>
                    <set token="AttributeCallUUID">$row.AttributeCallUUID$</set>
          </condition>
 </drilldown>
         <option name="wrap">undefined</option>
         <option name="rowNumbers">undefined</option>
         <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
         <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
         <option name="charting.axisTitleX.visibility">visible</option>
         <option name="charting.axisTitleY.visibility">visible</option>
         <option name="charting.axisTitleY2.visibility">visible</option>
         <option name="charting.axisX.scale">linear</option>
         <option name="charting.axisY.scale">linear</option>
         <option name="charting.axisY2.enabled">0</option>
         <option name="charting.axisY2.scale">inherit</option>
         <option name="charting.chart">bubble</option>
         <option name="charting.chart.bubbleMaximumSize">50</option>
         <option name="charting.chart.bubbleMinimumSize">10</option>
         <option name="charting.chart.bubbleSizeBy">area</option>
         <option name="charting.chart.nullValueMode">gaps</option>
         <option name="charting.chart.showDataLabels">none</option>
         <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
         <option name="charting.chart.stackMode">default</option>
         <option name="charting.chart.style">shiny</option>
         <option name="charting.drilldown">all</option>
         <option name="charting.layout.splitSeries">0</option>
         <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
         <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
         <option name="charting.legend.placement">right</option>
         <option name="dataOverlayMode">none</option>
         <option name="drilldown">row</option>
         <option name="count">10</option>
       </table>
     </panel>
   </row>
   <row>
     <panel depends="$tok_ShowEvents$">
       <event>
         <search>
           <query>index=windowsapps sourcetype=Genesys_AvayaTserver earliest=$e$ latest=$l$ | rex "(Trc|Adjusted|distribute_event|distribute_user_event|send_to_client|distribute_response):?\s\w+\s(?&lt;EventName&gt;\w+)"| rex "AttributeConnID'?\s'?(?&lt;AttributeConnID&gt;[^\t\n\r]+)"| rex "AttributeANI'?\s'?(?&lt;AttributeANI&gt;[^\t\n\r]+)"| rex "AttributeDNIS'?\s'?(?&lt;AttributeDNIS&gt;[^\t\n]+)"| rex "AttributeCallType'?\s'?(?&lt;AttributeCallType&gt;[^\t\n]+)"| rex "AttributeCallUUID'?\s'?(?&lt;AttributeCallUUID&gt;[^\t\n]+)"| rex "AttributeUserData'?\s'?(?&lt;AttributeUserData&gt;[^\t\n]+)"</query>
           <earliest></earliest>
           <latest></latest>
         </search>
       </event>
     </panel>
   </row>
 </form>

Re: Invalid value Drilldown error

ssingh313 — Thu, 04 Aug 2016 18:18:47 GMT

so I try this query and get a Error in 'eval' command: The expression is malformed. Expected ).

 <query>index=windowsapps sourcetype=Genesys_AvayaTserver "$tok_ID$" | eval filter=if(_time&lt;relative_time($e$, "-1s") OR _time&gt;relative_time($e$,relative_time($e$, "+1s"), "No", "Yes") | where filter="Yes"</query>

Re: Invalid value Drilldown error

ssingh313 — Fri, 05 Aug 2016 17:25:05 GMT

my code looks like this but I still get a "Search is waiting for input... " error. Is there another method to test this?

Re: Invalid value Drilldown error

ssingh313 — Fri, 05 Aug 2016 17:27:52 GMT

Let me know if there are any other possible ideas

Re: Invalid value Drilldown error

somesoni2 — Fri, 05 Aug 2016 18:47:04 GMT

There is a textbox, do you have a default value set for that? I copied the code from one of your code and the * gets truncated sometime in comments. So check that and assign a default value to your <input type="text" token="tok_ID"

Re: Invalid value Drilldown error

ssingh313 — Fri, 05 Aug 2016 19:25:45 GMT

That textbox is used to search specific attributes in the table so there isn't a defaultt value for that. I want the logs to be able to be displayed once you click on that attribute regardless of there be something in the search box or not. is that possible?

Re: Invalid value Drilldown error

somesoni2 — Fri, 05 Aug 2016 19:32:06 GMT

To facilitate that only we need to set some default value to the text box. It can either be some spaces OR best *. So Splunk will load the table on dashboard load and filter the data when the value is changed in the text box.

Try this first for your input text

<input type="text" token="tok_ID" searchWhenChanged="true">
        <label>ConnID/CallUUID</label>
        <default>   </default>
      </input>

If it doesn't work, then try this

<input type="text" token="tok_ID" searchWhenChanged="true">
        <label>ConnID/CallUUID</label>
        <default>*</default>
      </input>

Re: Invalid value Drilldown error

ssingh313 — Fri, 05 Aug 2016 19:47:21 GMT

It tried both and it still gives me the same error