Dashboards & Visualizations

Dashboard search waiting for input while token is present

pvdijssel
Engager

Hi,

I got this dashboard in which I work with tokens to select specific customer data. By selecting the correct customer, the drop down menu pushes a customer number (formatted like 30001, 30002,... 30999) to all searches within the dashboard. This is working flawless.

Now I created a new search within that same dashboard that only uses the trailing number (1,2, ... 999). If I test this in a normal search by pushing the customer id via an eval into the cust_id field it works. But the same search with tokens in a dashboards returns the error "wating on input". Can't debug it either because there is no sid.

 

Working search:

 

index=x sourcetype=x 
| eval regid=30001
| eval cust_id=$regid$
| rex field=cust_id mode=sed "s/(^30*)//1"
| where port==$cust_id$
| top limit=1 port

 

 

NOT working dashboard search:

 

index=x sourcetype=x 
| eval cust_id=$regid$
| rex field=cust_id mode=sed "s/(^30*)//1"
| where port==$cust_id$
| top limit=1 port

 

 

 

Labels (1)
0 Karma

jhanvidattani
Path Finder

Can you share dashboard code with inputs and 1/2 panels? So, it would be easy to debug further.

0 Karma

pvdijssel
Engager

Dashboard code:

<form theme="light">
  <label>Customer Dashboard (Clone)</label>
  <fieldset submitButton="true" autoRun="false">
    <input type="dropdown" token="regid" searchWhenChanged="false">
      <label>Customer</label>
      <choice value="30001">Customer X (1)</choice>
      <choice value="30023">Customer Y (23)</choice>
      <choice value="30097">Customer Z (97)</choice>
      <search>
        <query/>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
    </input>
    <input type="time" token="field1">
      <label></label>
      <default>
        <earliest>-60m@m</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <title>TEST regid: $regid$</title>
        <search>
          <query>index=X sourcetype=X
| eval cust_id=$regid$
| top limit=1 cust_id</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <title>searching registration id: $regid$</title>
      <chart>
        <title>Title</title>
        <search>
          <query>index=Y sourcetype=Y Destination="*$regid$*" 
| timechart  span=5m max(Calls) by Cust_ID limit=0
| addtotals</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
          <refresh>10m</refresh>
          <refreshType>delay</refreshType>
        </search>
        <option name="charting.chart">column</option>
        <option name="charting.chart.showDataLabels">minmax</option>
        <option name="charting.drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </chart>
    </panel>
  </row>
  <row>
    <panel>
      <chart>
        <title>R-Factor</title>
        <search>
          <query>index=X sourcetype=X
| eval cust_id=$regid$
| rex field=cust_id mode=sed "s/(^30*)//1"
| where port==$cust_id$
| top limit=1 port</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
        </search>
        <option name="charting.chart">line</option>
        <option name="charting.drilldown">none</option>
        <option name="height">363</option>
        <option name="refresh.display">progressbar</option>
      </chart>
    </panel>
  </row>
  <row>
    <panel>
      <chart>
        <title>Title</title>
        <search>
          <query>index=Y sourcetype=Y Destination=$regid$ 
| timechart span=1d max(Calls) by Cust_ID
    | addtotals
    | fields Total
    | timechart span=1d max(Total)</query>
          <earliest>-30d@d</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.axisTitleX.visibility">collapsed</option>
        <option name="charting.chart">column</option>
        <option name="charting.chart.showDataLabels">all</option>
        <option name="charting.drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </chart>
    </panel>
  </row>
</form>

 

Dashboard screenshot:

Splunk dashboard.PNG

0 Karma
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...