How to create a drop-down to show counter information based on host?

idab — Thu, 03 Sep 2015 17:19:42 GMT

Hi everyone,

Need help with my XML below. I need to create a drop-down to display certain data based on the host and counter fields.

I can't figure out how to make the drop-down display the Avg. Disk sec/Transfer and Avg. Disk Bytes/Transfer for a host when selected on the same dashboard, even though the search works properly when running as a report. My search question is how do I create the search to display the Avg. Disk sec/Transfer and Avg. Disk Bytes/Transfer for a selected host on the drop-down?

code Here:

<form>
  <label>DEMO </label>
  <fieldset submitButton="true" autoRun="true">
    <input type="dropdown" token="host" searchWhenChanged="true">
      <label>Host</label>
      <search>
        <query>| metadata type=hosts index=* | table host</query>
        <earliest>-4h@m</earliest>
        <latest>now</latest>
      </search>
      <fieldForLabel>host</fieldForLabel>
      <fieldForValue>host</fieldForValue>
    </input>
    <input type="time" token="disk">
      <label>select time</label>
      <default>
        <earliest>-4h@m</earliest>
        <latest>now</latest>
      </default>
    </input>
    <panel>
      <title> IOPS Latency</title>
      <chart>
        <search>
          <query>index=perfmon counter="Avg. Disk sec/Transfer"  Host="*" collection=LogicalDisk earliest=-1m [search index=perfmon counter="*"  Host="*"   collection=LogicalDisk earliest=-1m | stats max(Value) as latency by host | sort 10 -Value | fields host ]  | eval dataValue= "avg disk sec/transfer:" + tostring(round(Value,3)*1000)  | makemv delim="," allowempty=true dataValue  | mvexpand dataValue  | eval part=split(dataValue,":")  | eval category = Host + ":" + mvindex(part,0)  | eval dataPoint = tonumber(mvindex(part,1))  | timechart span=1s latest(dataPoint) by category
</query>

Re: How to create a drop-down to show counter information based on host?

jensonthottian — Thu, 03 Sep 2015 18:48:53 GMT

It seems you have'nt used the token for the host selected in your search string .

use --Host="$host$" --instead of Host="*" ,throughout both the search strings.

Re: How to create a drop-down to show counter information based on host?

idab — Thu, 03 Sep 2015 21:18:03 GMT

Thanks jensothian. 😉

Re: How to create a drop-down to show counter information based on host?

somesoni2 — Fri, 04 Sep 2015 18:47:55 GMT

If this has resolved your issue, do remember to accept the answer by clicking on the tick mark Accept button/link below the answer.

topic How to create a drop-down to show counter information based on host? in Splunk Search

How to create a drop-down to show counter information based on host?

Re: How to create a drop-down to show counter information based on host?

Re: How to create a drop-down to show counter information based on host?

Re: How to create a drop-down to show counter information based on host?