topic Re: How to create a button on the dashboard to control when a search is executed? in Splunk Search

How to create a button on the dashboard to control when a search is executed?

johnraftery — Tue, 16 Feb 2016 10:24:26 GMT

Hi,

I have a search in my dashboard that is quiet expensive - it can take over a minute to complete. The result is shown in a pie chart:

          <chart>
            <search>
              <query>...</query>
            </search>
            <option name="charting.chart">pie</option>
          </chart>

Because the search takes so long and is needed infrequently, I don't want it to run automatically. I want to have a button in the dashboard, and only when the button is clicked should the search be run. Is this possible?

Thanks for reading,
John Raftery

Re: How to create a button on the dashboard to control when a search is executed?

gyslainlatsa — Tue, 16 Feb 2016 10:45:11 GMT

i johnraftery,

it's possible, insert one token in your query.

please post your whole code and i try to help you.

Re: How to create a button on the dashboard to control when a search is executed?

johnraftery — Tue, 16 Feb 2016 10:56:43 GMT

Thanks very much - here is my code

  <row>
    <panel>
      <chart>
        <title>Consolidations in engine</title>
        <search>
          <query>| dbxquery connection=$host_token$ query="SELECT      rsk.M_LABEL Risk
FROM        LIUTABLE_DBF utable     
LEFT JOIN LIENG_DBF eng ON utable.M_UT_KEY=eng.M_UT_KEY     
LEFT JOIN LIRSKCFG_DBF rsk ON eng.M_RSK_KEY=rsk.M_KEY               
LEFT JOIN LICTPL_DBF first_ctp ON utable.M_VAR_KEY=first_ctp.M_KEY         
LEFT JOIN LICONSOM_DBF first_consom ON rsk.M_TREE=first_consom.M_TLABEL     
LEFT JOIN LICONSOL_DBF first_consol ON first_consom.M_INDEX=first_consol.M_CONSO AND utable.M_VAR_KEY=first_consol.M_KEY                                 
LEFT JOIN LIGTB_DBF second_gtb ON utable.M_GTB_KEY=second_gtb.M_KEY     
LEFT JOIN LICTPL_DBF second_ctp ON second_gtb.M_VAR_KEY=second_ctp.M_KEY                
LEFT JOIN LICONSOM_DBF second_consom ON rsk.M_TREE2=second_consom.M_TLABEL     
LEFT JOIN LICONSOL_DBF second_consol ON second_consom.M_INDEX=second_consol.M_CONSO AND second_gtb.M_VAR_KEY=second_consol.M_KEY                               
LEFT JOIN LIGRPCFG_DBF second_grpcfg ON second_gtb.M_GRP_KEY=second_grpcfg.M_KEY" shortnames=1 | stats count by RISK</query>
        </search>
        <option name="charting.chart">pie</option>
        <option name="height">600</option>
        <drilldown>
          <set token="dummy_token">0</set>
        </drilldown>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">right</option>
      </chart>
    </panel>
  </row>
</form>

Re: How to create a button on the dashboard to control when a search is executed?

gyslainlatsa — Tue, 16 Feb 2016 11:40:14 GMT

hi,

try to use this code in your code

<form>
  <label>Internal_Source</label>
 <row>
    <panel>  
      <input type="radio" token="" searchWhenChanged="true">
        <choice value="1">Launch Request</choice>
        <default></default>

        <change>
          <condition value="1">
            <set token="new_search"> index=_internal |stats count by source </set>
          </condition>
        </change>
      </input>

      <chart>
        <search>
          <query>$new_search$</query>
          <earliest>-4h@m</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.chart">pie</option>
      </chart>
    </panel>
  </row>
</form>

Add to your code, you will have a final code like this.

<row>
     <panel>

<input type="radio" token="" searchWhenChanged="true">
        <choice value="1">Launch Request</choice>
        <default></default>

        <change>
          <condition value="1">
            <set token="new_search">| dbxquery connection=$host_token$ query="SELECT      rsk.M_LABEL Risk
 FROM        LIUTABLE_DBF utable     
 LEFT JOIN LIENG_DBF eng ON utable.M_UT_KEY=eng.M_UT_KEY     
 LEFT JOIN LIRSKCFG_DBF rsk ON eng.M_RSK_KEY=rsk.M_KEY               
 LEFT JOIN LICTPL_DBF first_ctp ON utable.M_VAR_KEY=first_ctp.M_KEY         
 LEFT JOIN LICONSOM_DBF first_consom ON rsk.M_TREE=first_consom.M_TLABEL     
 LEFT JOIN LICONSOL_DBF first_consol ON first_consom.M_INDEX=first_consol.M_CONSO AND utable.M_VAR_KEY=first_consol.M_KEY                                 
 LEFT JOIN LIGTB_DBF second_gtb ON utable.M_GTB_KEY=second_gtb.M_KEY     
 LEFT JOIN LICTPL_DBF second_ctp ON second_gtb.M_VAR_KEY=second_ctp.M_KEY                
 LEFT JOIN LICONSOM_DBF second_consom ON rsk.M_TREE2=second_consom.M_TLABEL     
 LEFT JOIN LICONSOL_DBF second_consol ON second_consom.M_INDEX=second_consol.M_CONSO AND second_gtb.M_VAR_KEY=second_consol.M_KEY                               
 LEFT JOIN LIGRPCFG_DBF second_grpcfg ON second_gtb.M_GRP_KEY=second_grpcfg.M_KEY" shortnames=1 | stats count by RISK  </set>
          </condition>
        </change>
      </input>

       <chart>
         <title>Consolidations in engine</title>
         <search>
           <query>$new_search$</query>
         </search>
         <option name="charting.chart">pie</option>
         <option name="height">600</option>
         <drilldown>
           <set token="dummy_token">0</set>
         </drilldown>
         <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
         <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
         <option name="charting.axisTitleX.visibility">visible</option>
         <option name="charting.axisTitleY.visibility">visible</option>
         <option name="charting.axisTitleY2.visibility">visible</option>
         <option name="charting.axisX.scale">linear</option>
         <option name="charting.axisY.scale">linear</option>
         <option name="charting.axisY2.enabled">0</option>
         <option name="charting.axisY2.scale">inherit</option>
         <option name="charting.chart.bubbleMaximumSize">50</option>
         <option name="charting.chart.bubbleMinimumSize">10</option>
         <option name="charting.chart.bubbleSizeBy">area</option>
         <option name="charting.chart.nullValueMode">gaps</option>
         <option name="charting.chart.showDataLabels">none</option>
         <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
         <option name="charting.chart.stackMode">default</option>
         <option name="charting.chart.style">shiny</option>
         <option name="charting.drilldown">all</option>
         <option name="charting.layout.splitSeries">0</option>
         <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
         <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
         <option name="charting.legend.placement">right</option>
       </chart>
     </panel>
   </row>
 </form>

try and tell me if it works.

Re: How to create a button on the dashboard to control when a search is executed?

johnraftery — Tue, 29 Sep 2020 08:45:35 GMT

I don't think it's possible to have a token inside a token, is it? My query starts with
"| dbxquery connection=$host_token$ "
$host_token$ will not be evaluated if it's inside another token, right?

Re: How to create a button on the dashboard to control when a search is executed?

gyslainlatsa — Tue, 16 Feb 2016 12:06:32 GMT

if it will be evaluated, try to execute before seeking to conclude,
I have had to work like this.

only the first token will block the request does not launch automatically.
Once you're gonna approved the execution of the query, the query will run without problems

Re: How to create a button on the dashboard to control when a search is executed?

johnraftery — Tue, 16 Feb 2016 12:08:09 GMT

I've tried this in the past, and it didn't work.

Re: How to create a button on the dashboard to control when a search is executed?

johnraftery — Tue, 16 Feb 2016 12:10:26 GMT

For anyone who is attempting the same thing, here is the solution I came up with. It uses a dropdown menu, rather than a button, so if anyone has a solution that uses a button, please share 🙂

      <input type="dropdown" token="run_consolidations_dropdown" searchWhenChanged="true">
        <label>Run query</label>
        <choice value="1">No</choice>
        <choice value="2">Yes</choice>
        <default>1</default>
        <change>
          <condition value="1">
            <unset token="run_consolidations"></unset>
          </condition>
          <condition value="2">
            <set token="run_consolidations">dbxquery</set>
          </condition>
        </change>
      </input>
      <chart depends="$run_consolidations$">
        <search>
          <query>| $run_consolidations$ connection=......

The run_consolidations token initially hides the chart and stops the query from running. When set by the dropdown, the chart is shown and query is run.

Re: How to create a button on the dashboard to control when a search is executed?

johnraftery — Tue, 16 Feb 2016 12:13:16 GMT

My solution above was similar to yours, the main difference was that the value of the token was just "dbxquery", rather than the whole query string. So when the token is unset, the query cannot run. Thanks for your suggestion.

Re: How to create a button on the dashboard to control when a search is executed?

gyslainlatsa — Tue, 16 Feb 2016 12:17:25 GMT

you are welcome