Hi,
I got this dashboard in which I work with tokens to select specific customer data. By selecting the correct customer, the drop down menu pushes a customer number (formatted like 30001, 30002,... 30999) to all searches within the dashboard. This is working flawless.
Now I created a new search within that same dashboard that only uses the trailing number (1,2, ... 999). If I test this in a normal search by pushing the customer id via an eval into the cust_id field it works. But the same search with tokens in a dashboards returns the error "wating on input". Can't debug it either because there is no sid.
Working search:
index=x sourcetype=x
| eval regid=30001
| eval cust_id=$regid$
| rex field=cust_id mode=sed "s/(^30*)//1"
| where port==$cust_id$
| top limit=1 port
NOT working dashboard search:
index=x sourcetype=x
| eval cust_id=$regid$
| rex field=cust_id mode=sed "s/(^30*)//1"
| where port==$cust_id$
| top limit=1 port
Can you share dashboard code with inputs and 1/2 panels? So, it would be easy to debug further.
Dashboard code:
<form theme="light">
<label>Customer Dashboard (Clone)</label>
<fieldset submitButton="true" autoRun="false">
<input type="dropdown" token="regid" searchWhenChanged="false">
<label>Customer</label>
<choice value="30001">Customer X (1)</choice>
<choice value="30023">Customer Y (23)</choice>
<choice value="30097">Customer Z (97)</choice>
<search>
<query/>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
</input>
<input type="time" token="field1">
<label></label>
<default>
<earliest>-60m@m</earliest>
<latest>now</latest>
</default>
</input>
</fieldset>
<row>
<panel>
<table>
<title>TEST regid: $regid$</title>
<search>
<query>index=X sourcetype=X
| eval cust_id=$regid$
| top limit=1 cust_id</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
<row>
<panel>
<title>searching registration id: $regid$</title>
<chart>
<title>Title</title>
<search>
<query>index=Y sourcetype=Y Destination="*$regid$*"
| timechart span=5m max(Calls) by Cust_ID limit=0
| addtotals</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
<refresh>10m</refresh>
<refreshType>delay</refreshType>
</search>
<option name="charting.chart">column</option>
<option name="charting.chart.showDataLabels">minmax</option>
<option name="charting.drilldown">none</option>
<option name="refresh.display">progressbar</option>
</chart>
</panel>
</row>
<row>
<panel>
<chart>
<title>R-Factor</title>
<search>
<query>index=X sourcetype=X
| eval cust_id=$regid$
| rex field=cust_id mode=sed "s/(^30*)//1"
| where port==$cust_id$
| top limit=1 port</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>
<option name="charting.chart">line</option>
<option name="charting.drilldown">none</option>
<option name="height">363</option>
<option name="refresh.display">progressbar</option>
</chart>
</panel>
</row>
<row>
<panel>
<chart>
<title>Title</title>
<search>
<query>index=Y sourcetype=Y Destination=$regid$
| timechart span=1d max(Calls) by Cust_ID
| addtotals
| fields Total
| timechart span=1d max(Total)</query>
<earliest>-30d@d</earliest>
<latest>now</latest>
</search>
<option name="charting.axisTitleX.visibility">collapsed</option>
<option name="charting.chart">column</option>
<option name="charting.chart.showDataLabels">all</option>
<option name="charting.drilldown">none</option>
<option name="refresh.display">progressbar</option>
</chart>
</panel>
</row>
</form>
Dashboard screenshot: