Dashboards & Visualizations

Dashboard search waiting for input while token is present

pvdijssel
Engager

Hi,

I got this dashboard in which I work with tokens to select specific customer data. By selecting the correct customer, the drop down menu pushes a customer number (formatted like 30001, 30002,... 30999) to all searches within the dashboard. This is working flawless.

Now I created a new search within that same dashboard that only uses the trailing number (1,2, ... 999). If I test this in a normal search by pushing the customer id via an eval into the cust_id field it works. But the same search with tokens in a dashboards returns the error "wating on input". Can't debug it either because there is no sid.

 

Working search:

 

index=x sourcetype=x 
| eval regid=30001
| eval cust_id=$regid$
| rex field=cust_id mode=sed "s/(^30*)//1"
| where port==$cust_id$
| top limit=1 port

 

 

NOT working dashboard search:

 

index=x sourcetype=x 
| eval cust_id=$regid$
| rex field=cust_id mode=sed "s/(^30*)//1"
| where port==$cust_id$
| top limit=1 port

 

 

 

Labels (1)
0 Karma

jhanvidattani
Path Finder

Can you share dashboard code with inputs and 1/2 panels? So, it would be easy to debug further.

0 Karma

pvdijssel
Engager

Dashboard code:

<form theme="light">
  <label>Customer Dashboard (Clone)</label>
  <fieldset submitButton="true" autoRun="false">
    <input type="dropdown" token="regid" searchWhenChanged="false">
      <label>Customer</label>
      <choice value="30001">Customer X (1)</choice>
      <choice value="30023">Customer Y (23)</choice>
      <choice value="30097">Customer Z (97)</choice>
      <search>
        <query/>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
    </input>
    <input type="time" token="field1">
      <label></label>
      <default>
        <earliest>-60m@m</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <title>TEST regid: $regid$</title>
        <search>
          <query>index=X sourcetype=X
| eval cust_id=$regid$
| top limit=1 cust_id</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <title>searching registration id: $regid$</title>
      <chart>
        <title>Title</title>
        <search>
          <query>index=Y sourcetype=Y Destination="*$regid$*" 
| timechart  span=5m max(Calls) by Cust_ID limit=0
| addtotals</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
          <refresh>10m</refresh>
          <refreshType>delay</refreshType>
        </search>
        <option name="charting.chart">column</option>
        <option name="charting.chart.showDataLabels">minmax</option>
        <option name="charting.drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </chart>
    </panel>
  </row>
  <row>
    <panel>
      <chart>
        <title>R-Factor</title>
        <search>
          <query>index=X sourcetype=X
| eval cust_id=$regid$
| rex field=cust_id mode=sed "s/(^30*)//1"
| where port==$cust_id$
| top limit=1 port</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
        </search>
        <option name="charting.chart">line</option>
        <option name="charting.drilldown">none</option>
        <option name="height">363</option>
        <option name="refresh.display">progressbar</option>
      </chart>
    </panel>
  </row>
  <row>
    <panel>
      <chart>
        <title>Title</title>
        <search>
          <query>index=Y sourcetype=Y Destination=$regid$ 
| timechart span=1d max(Calls) by Cust_ID
    | addtotals
    | fields Total
    | timechart span=1d max(Total)</query>
          <earliest>-30d@d</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.axisTitleX.visibility">collapsed</option>
        <option name="charting.chart">column</option>
        <option name="charting.chart.showDataLabels">all</option>
        <option name="charting.drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </chart>
    </panel>
  </row>
</form>

 

Dashboard screenshot:

Splunk dashboard.PNG

0 Karma
Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...