dropdown and multiselect greyed out

[sarit_s]

hello,
i have a dashboard with multiselect input and dropdown input but for some reason they are both greyed out and the search is not updating after selecting at the first time.
also i have no option to configure default value for both of them

<form>
  <label>List of Pause Events with Times</label>
  <fieldset submitButton="false">
    <input type="multiselect" token="serialnumber" searchWhenChanged="false">
      <label>Serial Number</label>
      <prefix>SerialNumber = </prefix>
      <fieldForLabel>sn</fieldForLabel>
      <fieldForValue>sn</fieldForValue>
      <search>
        <query>index="emea_fdm" | `SerialNumber`</query>
        <earliest>0</earliest>
        <latest></latest>
      </search>
      <delimiter>OR</delimiter>
    </input>
    <input type="dropdown" token="sourcetype" searchWhenChanged="false">
      <label>Source Type</label>
      <prefix>sourcetype = "</prefix>
      <suffix>"</suffix>
      <fieldForLabel>st</fieldForLabel>
      <fieldForValue>st</fieldForValue>
      <search>
        <query>index="emea_fdm" sourcetype="fdm_*_system"</query>
        <earliest>0</earliest>
        <latest></latest>
      </search>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>EMEA</title>
      <table>
        <search ref="List of Pause Events with Times"></search>
        <option name="count">20</option>
        <option name="drilldown">cell</option>
        <drilldown>
          <link target="_blank">/app/St/report?s=SSYS-List%20of%20Pause%20Events%20with%20Times</link>
        </drilldown>
      </table>
    </panel>
  </row>
</form>

[kamlesh_vaghela · Accepted solution]

@sarit_s

Can you please confirm your searches are returning results?

index="emea_fdm" | `SerialNumber`


index="emea_fdm" sourcetype="fdm_*_system"

[Updated]

The issue is resolved.

The serialnumber macro was missing. We have updated searches during troubleshooting. All the followed troubleshooting steps are mentioned in the below comments.

Happy Splunking

[sarit_s]

yes they are

[kamlesh_vaghela]

@sarit_s

This is just for troubleshooting:

Can you please try by adding static value in both multiselects?

<choice value="Data1">Value1</choice>

It looks like this:

<fieldset submitButton="false">
    <input type="multiselect" token="serialnumber" searchWhenChanged="false">
      <label>Serial Number</label>
      <prefix>SerialNumber = </prefix>
      <fieldForLabel>sn</fieldForLabel>
      <fieldForValue>sn</fieldForValue>
      <search>
        <query>index="emea_fdm" | `SerialNumber`</query>
        <earliest>0</earliest>
        <latest></latest>
      </search>
      <delimiter>OR</delimiter>
      <choice value="Data1">Value1</choice>
    </input>
    <input type="dropdown" token="sourcetype" searchWhenChanged="false">
      <label>Source Type</label>
      <prefix>sourcetype = "</prefix>
      <suffix>"</suffix>
      <fieldForLabel>st</fieldForLabel>
      <fieldForValue>st</fieldForValue>
      <search>
        <query>index="emea_fdm" sourcetype="fdm_*_system"</query>
        <earliest>0</earliest>
        <latest></latest>
      </search>
      <choice value="Data1">Value1</choice>
    </input>
  </fieldset>

[sarit_s]

its now not grayed out but it canceled the dynamic search

[kamlesh_vaghela]

@sarit_s

Can you please update searches with below and try?

 index="emea_fdm" sn=* | head 10 | `SerialNumber` | table sn


 index="emea_fdm" sourcetype="fdm_*_system" st=* | head 10 | table st

[kamlesh_vaghela]

@sarit_s

Can you please try these searches in search bar?? Make sure the app context would be the same for search bar which your dashboard belongs. I think your searches are not returning results properly or search being failed during execution.

For Source Type search: there is a space between head and 10 like head 10

[sarit_s]

both your searches returning no result but my searches returning results

[kamlesh_vaghela]

@sarit_s

If searches are not returning any events then your events don't have filed sn and st. Can you please check it?

index="emea_fdm" | table time sn _raw
index="emea_fdm" sourcetype="fdm*_system" | table _time st _raw

Please open search bar using below URL.

https://<<SPLUNK>>:8000/en-GB/app/<<MY_APP>>/search

where
<<SPLUNK>> is your Splunk instance
<<MY_APP>> is your app folder name

[sarit_s]

i have field "sourcetype" and field "SerialNumber"
changing Field For Label and Field For Value to be sourcetype and SerialNumber didn't change anything

[kamlesh_vaghela]

@sarit_s

Can you please try below search for second multi-select?

index="" sourcetype="fdm__system" | fields sourcetype

[sarit_s]

does not return anything
but if im changing it to index="" sourcetype="fdm__system" | fields sourcetype it returns results

[kamlesh_vaghela]

@sarit_s

my bad. I forget to press ctrl+K. 🙂 🙂

Try this:

index="*" sourcetype="fdm_*_system" | fields sourcetype

[sarit_s]

i updated my answer , i add * by myself 🙂
with * it returning results

[kamlesh_vaghela]

@sarit_s

So I think the problem is with index name. Can you please check index name by executing below search??

index="*" sourcetype="fdm_*_system" | stats count sourcetype, index

And I think we are populating dropdown. So our searches should be like this.

index="emea_fdm"  | `SerialNumber` | dedup SerialNumber | table SerialNumber


 index="emea_fdm" sourcetype="fdm_*_system" | dedup sourcetype | table 

But can you please try below in your dashboard?

index="*"  | `SerialNumber` | dedup SerialNumber | table SerialNumber


 index="*" sourcetype="fdm_*_system" | dedup sourcetype | table 

[sarit_s]

ok so this searches fixed the error msg but still if i choose one of the options it does not change the panel results.
actually nothing happens..
also, i want sourcetype dropdown to update automatically after choosing serialnumber and also serialnumber to update automatically after choosing sorucetype.
is it possible ?

[kamlesh_vaghela]

ooh..

So you need to create a token which can be used in another search. For that, you have to add <change> tag in select input.

Please check below link for same:

https://docs.splunk.com/Documentation/Splunk/7.2.5/Viz/PanelreferenceforSimplifiedXML#change_.28form...

[sarit_s]

hi.
i think that something basic in missing since im getting very weird error msg
"Error in 'table' command: Invalid argument: '-'
i have no idea what this error is about since i don't have this argument in my search

List of Pause Events with Times

Serial Number
SerialNumber =
sn
SerialNumber

index="emea_fdm" | rex field=source \/ssyssplunk\/\w+\/\w+\/\w+\/\w+\/(?<SerialNumber>\w+) | dedup SerialNumber |table SerialNumber
0




Source Type
sourcetype =
st
sourcetype

index="emea_fdm" sourcetype="fdm__system" |dedup sourcetype |table sourcetype
0


<choice value="">ALL
*

index="emea_fdm" pauseReason: NOT "pauseReason: NotPaused" pauseReason: NOT "pauseReason: UserPaused" |rex field=source \/ssyssplunk\/\w+\/\w+\/\w+\/\w+\/(?<SerialNumber>\w+)|rex "pauseReason:\s+(?<pause_reason>\w+)"| table _time pause_reason $SerialNumber$ $sourcetype$ source
0


none

[sarit_s]

also, i saw this :

Note: The element is not
available for multiselect inputs.

so , if i want to use multiselect, how can i do it ?

[kamlesh_vaghela]

@sarit_s

Can you please share your sample dashboard XML?

[sarit_s]

few updates
i succeeded to refresh the dropdowns if one of them is changing
but the event list does not change when changing the "SerialNumber" dropdown
if changing "sourcetype" dropdown it is working
also, i need "SerialNumber" to be multiselect or any other type only to be able to choose more than one option
and also, the option "ALL" is not working. if im configuring "ALL=*" im getting error

  <label>panel test</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="Region" searchWhenChanged="true">
      <label>Region</label>
      <choice value="ALL">ALL</choice>
      <choice value="EMEA">EMEA</choice>
      <choice value="APJ">APJ</choice>
    </input>
    <input type="dropdown" token="sourcetype" searchWhenChanged="true">
      <label>SourceType</label>
      <choice value="ALL">ALL</choice>
      <fieldForLabel>sourcetype</fieldForLabel>
      <fieldForValue>sourcetype</fieldForValue>
      <search>
        <query>index="$Region$_fdm" sourcetype="fdm_*_system" |dedup sourcetype |table sourcetype</query>
        <earliest>0</earliest>
        <latest></latest>
      </search>
    </input>
    <input type="dropdown" token="serialNumber" searchWhenChanged="true">
      <label>SerialNumber</label>
      <choice value="ALL">ALL</choice>
      <fieldForLabel>SerialNumber</fieldForLabel>
      <fieldForValue>SerialNumber</fieldForValue>
      <search>
        <query>index="$Region$_fdm" sourcetype=$sourcetype$ | rex field=source \/ssyssplunk\/\w+\/\w+\/\w+\/\w+\/(?&lt;SerialNumber&gt;\w+) | dedup SerialNumber |table SerialNumber</query>
        <earliest>0</earliest>
        <latest></latest>
      </search>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>paused reasons by Region</title>
      <table>
        <title>$Region$</title>
        <search>
          <query>index="$Region$_fdm"  sourcetype=$sourcetype$ pauseReason: NOT "pauseReason: NotPaused" pauseReason: NOT "pauseReason: UserPaused" |`SerialNumber`=$SerialNumber$| `pauseReason` | table _time pause_reason SerialNumber sourcetype source</query>
          <earliest>0</earliest>
          <latest></latest>
        </search>
        <option name="count">10</option>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</form>