Hi I have a drop down based on domain ,entity so when i select domain , entity and date selected it fetch result of initlambda,init duplicate,init error...I want to have a extra submit button ,once i hit submit then only run the result for initlambda,init duplicate,init error otherwise dont fetch anything
<row>
<panel>
<title> VIEW BY ENTITY</title>
<input type="dropdown" token="tokEnvironment" searchWhenChanged="true">
<label>Domain</label>
<choice value="Costing">Costing</choice>
<change>
<set token="inputToken">""</set>
<set token="outputToken">""</set>
<set token="inputToken2">""</set>
<set token="outputToken2">""</set>
<unset token="tokSystem"></unset>
<unset token="form.tokSystem"></unset>
</change>
<default>Cost</default>
<initialValue>Cost</initialValue>
</input>
<input type="dropdown" token="tokSystem" searchWhenChanged="false">
<label>Data Entity</label>
<fieldForLabel>$tokEnvironment$</fieldForLabel>
<fieldForValue>$tokEnvironment$</fieldForValue>
<search>
<!--<progress>-->
<!-- match attribute for condition uses eval-like expression (see Splunk search language 'eval' command) -->
<!-- logic: if resultCount is 0, then show a static html element, and hide the chart element -->
<!-- <condition match="'job.resultCount'== 0">-->
<!-- <set token="show_html">true</set>-->
<!-- </condition>-->
<!-- <condition>-->
<!-- <unset token="show_html"/>-->
<!-- </condition>-->
<!-- </progress>-->
<query>| makeresults
| fields - _time
| eval Costing="GetQuoteByCBD,bolHeader,bolLineItems,laborProcess,costSheetCalc,FOB"
| fields $tokEnvironment$
| makemv $tokEnvironment$ delim=","
| mvexpand $tokEnvironment$</query>
</search>
<change>
<condition match="$label$=="get"">
<set token="inputToken">get</set>
<set token="outputToken">get</set>
<set token="inputToken2">b</set>
<set token="outputToken2">b</set>
<set token="inputToken3">c</set>
<set token="outputToken3">c</set>
<set token="inputToken4">d</set>
<set token="outputToken4">d</set>
<set token="inputToken5">e</set>
<set token="outputToken5">e</set>
<set token="inputToken4">d</set>
<set token="outputToken4">d</set>
<set token="inputToken3">3</set>
<set token="outputToken3">3</set>
<set token="apiToken">d</set>
<set token="entityToken">get</set>
</condition>
<condition match="$label$=="batch"">
<set token="inputToken">batch</set>
<set token="outputToken">batch</set>
<set token="inputToken2">c</set>
<set token="outputToken2">c</set>
<set token="inputToken">b</set>
<set token="outputToken4">b</set>
<set token="inputToken3">d</set>
<set token="outputToken3">d</set>
<set token="apiToken">b</set>
<set token="inputToken5">f</set>
<set token="outputToken5">f</set>
<set token="entityToken">batch</set>
</condition>
</condition>
<condition match="$label$=="Calc"">
<set token="inputToken">Calc</set>
<set token="outputToken">Calc</set>
<set token="inputToken2">init</set>
<set token="outputToken2">init</set>
<set token="inputToken">Calc</set>
<set token="outputToken4">Calc</set>
<set token="inputToken3">d</set>
<set token="outputToken3">d</set>
<set token="apiToken">Calc</set>
<set token="entityToken">Calc</set>
</condition>
</change>
<default>get</default>
</input>
<input type="time" token="time_picker" searchWhenChanged="true">
<label>Time</label>
<default>
<earliest>-15m</earliest>
<latest>now</latest>
</default>
</input>
<html>
<u1> </u1>
</html>
</panel>
</row>
<row>
<panel>
<title>Init Lambda</title>
<table>
<search>
<query>index="" source IN ("/aws/lambda/aa-$outputToken$-$stageToken$-$outputToken2$") | spath msg | search msg="gemini:streaming:info:*" | stats count by msg</query>
<earliest>$time_picker.earliest$</earliest>
<latest>$time_picker.latest$</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="dataOverlayMode">heatmap</option>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
<panel>
<title>Init Lambda - Duplicate</title>
<table>
<search>
<query>index="" source IN ("/aws/lambda/aa-$outputToken$-$stageToken$-$outputToken2$") | spath msg | search msg="gemini:streaming:warning:*" | stats count by msg</query>
<earliest>$time_picker.earliest$</earliest>
<latest>$time_picker.latest$</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="dataOverlayMode">heatmap</option>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
<panel>
<title>Init Lambda - Error</title>
<table>
<search>
<query>index=""source IN ("/aws/lambda/aa-$outputToken$-$stageToken$-$outputToken2$") | spath msg | search msg="gemini:streaming:error:*" | stats count by msg</query>
<earliest>$time_picker.earliest$</earliest>
<latest>$time_picker.latest$</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="dataOverlayMode">heatmap</option>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
<input type="dropdown" token="tokEnvironment" searchWhenChanged="true">
This is the problem, this triggers the search when this token changes, you have it in time as well.
Here is a sample board I've created with multiple panels and different searches. It will only trigger on submit button press.
<form version="1.1" theme="dark">
<label>Answers - Classic</label>
<fieldset submitButton="true">
<input type="dropdown" token="tok_idx">
<label>Indexes</label>
<fieldForLabel>index</fieldForLabel>
<fieldForValue>index</fieldForValue>
<search>
<query>| tstats count where index=_* by index</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
</input>
<input type="time" token="tok_time" searchWhenChanged="false">
<label>Time</label>
<default>
<earliest>-24h@h</earliest>
<latest>now</latest>
</default>
</input>
</fieldset>
<row>
<panel>
<title>$tok_idx$ :: $tok_time$</title>
<chart>
<title>Total Events</title>
<search>
<query>| tstats count where index=$tok_idx$ by _time span=1h</query>
<earliest>$tok_time.earliest$</earliest>
<latest>$tok_time.latest$</latest>
</search>
<option name="charting.chart">column</option>
<option name="charting.drilldown">none</option>
</chart>
</panel>
<panel>
<title>$tok_idx$ :: $tok_time$</title>
<chart>
<title>Total Events by Sourcetype</title>
<search>
<query>| tstats count where index=$tok_idx$ by _time sourcetype span=1h
| timechart sum(count) by sourcetype</query>
<earliest>$tok_time.earliest$</earliest>
<latest>$tok_time.latest$</latest>
</search>
<option name="charting.chart">column</option>
<option name="charting.drilldown">none</option>
</chart>
</panel>
</row>
</form>
<row>
<panel>
<title> VIEW BY ENTITY</title>
<input type="dropdown" token="tokEnvironment" searchWhenChanged="true">
<label>Domain</label>
<choice value="Costing">Costing</choice>
<change>
<set token="inputToken">""</set>
<set token="outputToken">""</set>
<set token="inputToken2">""</set>
<set token="outputToken2">""</set>
<unset token="tokSystem"></unset>
<unset token="form.tokSystem"></unset>
</change>
<default>Cost</default>
<initialValue>Cost</initialValue>
</input>
<input type="dropdown" token="tokSystem" searchWhenChanged="false">
<label>Data Entity</label>
<fieldForLabel>$tokEnvironment$</fieldForLabel>
<fieldForValue>$tokEnvironment$</fieldForValue>
<search>
<!--<progress>-->
<!-- match attribute for condition uses eval-like expression (see Splunk search language 'eval' command) -->
<!-- logic: if resultCount is 0, then show a static html element, and hide the chart element -->
<!-- <condition match="'job.resultCount'== 0">-->
<!-- <set token="show_html">true</set>-->
<!-- </condition>-->
<!-- <condition>-->
<!-- <unset token="show_html"/>-->
<!-- </condition>-->
<!-- </progress>-->
<query>| makeresults
| fields - _time
| eval Costing="GetQuoteByCBD,bolHeader,bolLineItems,laborProcess,costSheetCalc,FOB"
| fields $tokEnvironment$
| makemv $tokEnvironment$ delim=","
| mvexpand $tokEnvironment$</query>
</search>
<change>
<condition match="$label$=="get"">
<set token="inputToken">get</set>
<set token="outputToken">get</set>
<set token="inputToken2">b</set>
<set token="outputToken2">b</set>
<set token="inputToken3">c</set>
<set token="outputToken3">c</set>
<set token="inputToken4">d</set>
<set token="outputToken4">d</set>
<set token="inputToken5">e</set>
<set token="outputToken5">e</set>
<set token="inputToken4">d</set>
<set token="outputToken4">d</set>
<set token="inputToken3">3</set>
<set token="outputToken3">3</set>
<set token="apiToken">d</set>
<set token="entityToken">get</set>
</condition>
<condition match="$label$=="batch"">
<set token="inputToken">batch</set>
<set token="outputToken">batch</set>
<set token="inputToken2">c</set>
<set token="outputToken2">c</set>
<set token="inputToken">b</set>
<set token="outputToken4">b</set>
<set token="inputToken3">d</set>
<set token="outputToken3">d</set>
<set token="apiToken">b</set>
<set token="inputToken5">f</set>
<set token="outputToken5">f</set>
<set token="entityToken">batch</set>
</condition>
</condition>
<condition match="$label$=="Calc"">
<set token="inputToken">Calc</set>
<set token="outputToken">Calc</set>
<set token="inputToken2">init</set>
<set token="outputToken2">init</set>
<set token="inputToken">Calc</set>
<set token="outputToken4">Calc</set>
<set token="inputToken3">d</set>
<set token="outputToken3">d</set>
<set token="apiToken">Calc</set>
<set token="entityToken">Calc</set>
</condition>
</change>
<default>get</default>
</input>
<input type="time" token="time_picker" searchWhenChanged="true">
<label>Time</label>
<default>
<earliest>-15m</earliest>
<latest>now</latest>
</default>
</input>
<html>
<u1> </u1>
</html>
</panel>
</row>
<row>
<panel>
<title>Init Lambda</title>
<table>
<search>
<query>index="" source IN ("/aws/lambda/aa-$outputToken$-$stageToken$-$outputToken2$") | spath msg | search msg="gemini:streaming:info:*" | stats count by msg</query>
<earliest>$time_picker.earliest$</earliest>
<latest>$time_picker.latest$</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="dataOverlayMode">heatmap</option>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
<panel>
<title>Init Lambda - Duplicate</title>
<table>
<search>
<query>index="" source IN ("/aws/lambda/aa-$outputToken$-$stageToken$-$outputToken2$") | spath msg | search msg="gemini:streaming:warning:*" | stats count by msg</query>
<earliest>$time_picker.earliest$</earliest>
<latest>$time_picker.latest$</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="dataOverlayMode">heatmap</option>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
<panel>
<title>Init Lambda - Error</title>
<table>
<search>
<query>index=""source IN ("/aws/lambda/aa-$outputToken$-$stageToken$-$outputToken2$") | spath msg | search msg="gemini:streaming:error:*" | stats count by msg</query>
<earliest>$time_picker.earliest$</earliest>
<latest>$time_picker.latest$</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="dataOverlayMode">heatmap</option>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
<input type="dropdown" token="tokEnvironment" searchWhenChanged="true">
This is the problem, this triggers the search when this token changes, you have it in time as well.
Here is a sample board I've created with multiple panels and different searches. It will only trigger on submit button press.
<form version="1.1" theme="dark">
<label>Answers - Classic</label>
<fieldset submitButton="true">
<input type="dropdown" token="tok_idx">
<label>Indexes</label>
<fieldForLabel>index</fieldForLabel>
<fieldForValue>index</fieldForValue>
<search>
<query>| tstats count where index=_* by index</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
</input>
<input type="time" token="tok_time" searchWhenChanged="false">
<label>Time</label>
<default>
<earliest>-24h@h</earliest>
<latest>now</latest>
</default>
</input>
</fieldset>
<row>
<panel>
<title>$tok_idx$ :: $tok_time$</title>
<chart>
<title>Total Events</title>
<search>
<query>| tstats count where index=$tok_idx$ by _time span=1h</query>
<earliest>$tok_time.earliest$</earliest>
<latest>$tok_time.latest$</latest>
</search>
<option name="charting.chart">column</option>
<option name="charting.drilldown">none</option>
</chart>
</panel>
<panel>
<title>$tok_idx$ :: $tok_time$</title>
<chart>
<title>Total Events by Sourcetype</title>
<search>
<query>| tstats count where index=$tok_idx$ by _time sourcetype span=1h
| timechart sum(count) by sourcetype</query>
<earliest>$tok_time.earliest$</earliest>
<latest>$tok_time.latest$</latest>
</search>
<option name="charting.chart">column</option>
<option name="charting.drilldown">none</option>
</chart>
</panel>
</row>
</form>
Thanks for the solution which worked When i select the data entity and the time and hit the submit button ...But without selecting the env test or prod the query get search based on the default dropdown applies to the query if it is test index as "np-ap" and sets stageToken as test.
I want the submit button to work even for the env selection ...along with data entity and date
index="np-ap" AND source="--a-test"
<query>index=$indexToken$ AND source="-a-$stageToken$"
<form version="1.1" theme="dark">
<label> stats</label>
<fieldset submitButton="true">
<input type="dropdown" token="indexToken1">
<label>Environment</label>
<choice value="pd-ap,prod">PROD</choice>
<choice value="np-ap,test">TEST</choice>
<change>
<eval token="stageToken">mvindex(split($value$,","),1)</eval>
<eval token="indexToken">mvindex(split($value$,","),0)</eval>
</change>
<default>np-ap,test</default>
</input>
<input type="dropdown" token="entityToken">
<label>Data Entity</label>
<choice value="aa">aa</choice>
<choice value="bb">bb</choice>
<choice value="cc">cc</choice>
<choice value="dd">dd</choice>
<choice value="ee">ee</choice>
<choice value="ff">ff</choice>
<default>aa</default>
</input>
<input type="time" token="timeToken" searchWhenChanged="false">
<label>Time</label>
<default>
<earliest>-24h@h</earliest>
<latest>now</latest>
</default>
</input>
</fieldset>
<row>
<panel>
<html id="APIStats">
<style>
#user{
text-align:center;
color:#BFFF00;
}
</style>
<h2 id="user">API</h2>
</html>
</panel>
</row>
<row>
<panel>
<table>
<title>Unique</title>
<search>
<query>index=$indexToken$ AND source="-a-$stageToken$"
| stats count </query>
<earliest>$timeToken.earliest$</earliest>
<latest>$timeToken.latest$</latest>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
</form>
When you force a default it will populate the token, as long as the token is populated then the search will return results. I would remove the default but I feel like you set that for a reason. So maybe I'm not understanding the full use case.
Currently without hitting the submit button,when i load the dashboard it get result of the below usage statistics of the selected test environment
Query used first checks if env is selected "test" then use "index" as "np-ap" and set "stageToken" as "test"
I want the submit button to work and get the result only after the env ,data entity and date is selected and hit the submit button
index="np-ap" AND source="--a-test"
<query>index=$indexToken$ AND source="-a-$stageToken$"
<form version="1.1" theme="dark">
<label> stats</label>
<fieldset submitButton="true">
<input type="dropdown" token="indexToken1">
<label>Environment</label>
<choice value="pd-ap,prod">PROD</choice>
<choice value="np-ap,test">TEST</choice>
<change>
<eval token="stageToken">mvindex(split($value$,","),1)</eval>
<eval token="indexToken">mvindex(split($value$,","),0)</eval>
</change>
</input>
<input type="dropdown" token="entityToken">
<label>Data Entity</label>
<choice value="aa">aa</choice>
<choice value="bb">bb</choice>
<choice value="cc">cc</choice>
<choice value="dd">dd</choice>
<choice value="ee">ee</choice>
<choice value="ff">ff</choice>
<default>aa</default>
</input>
<input type="time" token="timeToken" searchWhenChanged="false">
<label>Time</label>
<default>
<earliest>-24h@h</earliest>
<latest>now</latest>
</default>
</input>
</fieldset>
<row>
<panel>
<html id="APIStats">
<style>
#user{
text-align:center;
color:#BFFF00;
}
</style>
<h2 id="user">API</h2>
</html>
</panel>
</row>
<row>
<panel>
<table>
<title>Unique</title>
<search>
<query>index=$indexToken$ AND source="-a-$stageToken$"
| stats count </query>
<earliest>$timeToken.earliest$</earliest>
<latest>$timeToken.latest$</latest>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
</form>
Oh and I put the tokens in my panel titles only as a sanity debug check. They have no reason to exist there once your dashboard is finalized.
My Dasboard runs the result of each row pannel even without the submit button is clicked....Trie giving the autoRun= false,searchwhenchanged=false.and submit button tag is added so search is only triggered when select dropdown & time is selected and they press submit button
waiting for reply