"Host Input" dropdown

[andreibanaru]

The host input dropdown in the Netskope App shows an error that it "Cound not create search.".

By looking at the dashboard xml source we observe:

            <label>Host Input</label>
            <default>*</default>
            <choice value="*">All</choice>
            <search>
                <query>| `netskope_configured_inputs`</query>
                <earliest>$time_range.earliest$</earliest>
                <latest>$time_range.latest$</latest>
            </search>

If we remove the leading pipe (|) from the query the error is gone.

The dropdown will now show the FQDN of the Netskope server which feeds the events. I'm wondering if this is the expected behavior. I would have expected to see the computer names under this dropdown.

[aplura_llc_supp]

v1.1.0 and v1.0.5 do contain this bug. The macro behind the dropdown was reconfigured, but this dropdown was missed. Look for a new maintenance release to fix this.

The app will also change from "Host Input" to something more clear, as it was intended to be the source Netskope tenant.

The macro should be changed to:

[netskope_configured_inputs]
definition = tstats count where sourcetype=netskope:* by host | fields host

Thanks!

[aplura_llc_supp]

@andreibanaru v1.1.1 was released to fix that bug. Thanks.

[aplura_llc_supp]

@andreibanaru What is the version you are using?

[andreibanaru]

Version 1.0.5

[aplura_llc_supp]

This bug is also present in v1.1.0, so it will be fixed in v1.1.1.

[andreibanaru]

Yeah, we've just installed 1.1.0 and we have the same behavior.

[dkeck]

HI,

depends on how your macro is set up, if it also starts with a pipe, its logical that it will not work if you have two.