Can a Dashboard Dropdown be based on Metric Index

[redmandba]

Hi Guys.

I've configured the Splunk_TA_nix plug-in running on a Linux server and this is providing data for a Metric Based Index in Splunk Enterprise v9.2.1

I've configured the most basic (Classic) Dashboard with just a dropdown and search based on this Index.

The drop down never populates, so my question is whether dropdown searches can be based on Metric Indexes?

My search works in the Search and Reporting field:

|mstat min(df_metric.*) WHERE (host=myhost) span=1h index="linux_os_metric" BY MountedOn
|stats values(MountedOn) as MountedOn
|sort MountedOn
|table MountedOn

It says populating and does not return an error, but the dropdown is greyed out and not selectable.
I was hoping it was going to present a list of mounted Filesystems

thanks in advance if anyone can solve this.

[gcusello]

Hi @redmandba ,

as @ITWhisperer said, you surely have a multivalue in MountedOn field and this isn't acceptable,

so use the BY clause:

| mstat min(df_metric.*) WHERE (host=myhost) span=1h index="linux_os_metric" BY MountedOn
| stats count BY MountedOn
| sort MountedOn
| table MountedOn

Ciao.

Giuseppe

[redmandba]

I tried removing the stats and have:

| mstat min(df_metric.*) WHERE (host=myhost) span=1h index="linux_os_metric" BY MountedOn
|table MountedOn

Still nothing in the dropdown

It would be useful to understand a bit more about how these results are returned as it seems you are implying that these results are not suitable for a <query> in dropdown?

Is there a way of converting the resultset to be non-multi value?

If I run the Search in Search & reporting I just get a list of Filesystems.

appreciate your input - thanks!

[gcusello · Accepted solution]

Hi @redmandba ,

if a search gives results, can be used in a dropdown.

Can you share the code of your dropdown? maybe the issue is in the other parameters.

Ciao.

Giuseppe

[redmandba]

@gcusello - You were correct, bad code

I hadn't understood the requirement for <fieldForValue>MountedOn</fieldForValue> 

Once set, the drop down populates

Thank you very much !!

[gcusello]

Hi @redmandba ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

[ITWhisperer]

The issue is probably that the stats values part of the search will give you a multivalue field in a single event when you actually need separate events for each value. Try removing the stats command.