Dashboards & Visualizations

Dashboard panel giving error"Search is waiting for input.."while using search base

nagamani_battul
New Member

Please refer the code below.
I have base query and subquery,I didnt see any data in the panel,It is giving error "searching is waiting for Input..".
Kindly verify and suggest how to resolve this issue?

    <form>
      <label>Power Data Fabric Dev OM Execution Metrics Clone</label>
      <description>Production System Metrics</description>
      <search id="base_Execution_Metrics">
        <query>index=us_west_dev_power_platform sourcetype=om:omagent  host="10.170.*" (ExecutionStatus="RS" OR ExecutionStatus="RF")
                | fields sourcetype, machine, esn, CalcId, ExecST, ExecWT, ExecutionStatus
                </query>
        <earliest>$timeRange.earliest$</earliest>
        <latest>$timeRange.latest$</latest>
        <sampleRatio>1</sampleRatio>
      </search>
      <fieldset submitButton="false">
        <input type="time" token="timepick">
          <label>Time Range</label>
          <default>
            <earliest>-24h@h</earliest>
            <latest>now</latest>
          </default>
        </input>
      </fieldset>
      <row>
        <panel id="ExecutionCountPerDay">
          <title>Executions Count by Day</title>
          <chart>
            <search base="base_Execution_Metrics">
              <query>| dedup sourcetype,machine,esn,CalcId,ExecST,ExecWT,ExecutionStatus | timechart span=1d count  by ExecutionStatus|eval "Total Executions(RS + RF)" = RF+RS| rename RF as "Failed Executions(RF)"|table _time, "Total Executions(RS + RF)", "Failed Executions(RF)"</query>
            </search>
            <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
            <option name="charting.axisLabelsX.majorLabelStyle.rotation">-45</option>
            <option name="charting.axisTitleX.visibility">visible</option>
            <option name="charting.axisTitleY.visibility">collapsed</option>
            <option name="charting.axisTitleY2.visibility">visible</option>
            <option name="charting.axisX.scale">linear</option>
            <option name="charting.axisY.abbreviation">auto</option>
            <option name="charting.axisY.scale">log</option>
            <option name="charting.axisY2.abbreviation">none</option>
            <option name="charting.axisY2.enabled">0</option>
            <option name="charting.axisY2.scale">inherit</option>
            <option name="charting.chart">column</option>
            <option name="charting.chart.bubbleMaximumSize">50</option>
            <option name="charting.chart.bubbleMinimumSize">10</option>
            <option name="charting.chart.bubbleSizeBy">area</option>
            <option name="charting.chart.nullValueMode">gaps</option>
            <option name="charting.chart.showDataLabels">all</option>
            <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
            <option name="charting.chart.stackMode">default</option>
            <option name="charting.chart.style">shiny</option>
            <option name="charting.drilldown">none</option>
            <option name="charting.fieldColors">{"Total Executions(RS + RF)":0xF1C40F, Failed Executions(RF)": 0xFF0000}</option>
            <option name="charting.layout.splitSeries">0</option>
            <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
            <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
            <option name="charting.legend.placement">bottom</option>
            <option name="link.exportResults.visible">1</option>
            <option name="link.visible">0</option>
            <option name="refresh.display">progressbar</option>
          </chart>
        </panel>
      </row>
</form>
Labels (1)
Tags (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @nagamani_battula,
there an error in rows 8 and 9: the name of the token from the Time Picker is different timepick instead of timeRange.
Ciao.
Giuseppe

View solution in original post

0 Karma

nagamani_battul
New Member

Thanks much.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @nagamani_battula,
there an error in rows 8 and 9: the name of the token from the Time Picker is different timepick instead of timeRange.
Ciao.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...