Dashboards & Visualizations

Dashboard search waiting for input while token is present

pvdijssel
Engager

Hi,

I got this dashboard in which I work with tokens to select specific customer data. By selecting the correct customer, the drop down menu pushes a customer number (formatted like 30001, 30002,... 30999) to all searches within the dashboard. This is working flawless.

Now I created a new search within that same dashboard that only uses the trailing number (1,2, ... 999). If I test this in a normal search by pushing the customer id via an eval into the cust_id field it works. But the same search with tokens in a dashboards returns the error "wating on input". Can't debug it either because there is no sid.

 

Working search:

 

index=x sourcetype=x 
| eval regid=30001
| eval cust_id=$regid$
| rex field=cust_id mode=sed "s/(^30*)//1"
| where port==$cust_id$
| top limit=1 port

 

 

NOT working dashboard search:

 

index=x sourcetype=x 
| eval cust_id=$regid$
| rex field=cust_id mode=sed "s/(^30*)//1"
| where port==$cust_id$
| top limit=1 port

 

 

 

Labels (1)
0 Karma

jhanvidattani
Path Finder

Can you share dashboard code with inputs and 1/2 panels? So, it would be easy to debug further.

0 Karma

pvdijssel
Engager

Dashboard code:

<form theme="light">
  <label>Customer Dashboard (Clone)</label>
  <fieldset submitButton="true" autoRun="false">
    <input type="dropdown" token="regid" searchWhenChanged="false">
      <label>Customer</label>
      <choice value="30001">Customer X (1)</choice>
      <choice value="30023">Customer Y (23)</choice>
      <choice value="30097">Customer Z (97)</choice>
      <search>
        <query/>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
    </input>
    <input type="time" token="field1">
      <label></label>
      <default>
        <earliest>-60m@m</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <title>TEST regid: $regid$</title>
        <search>
          <query>index=X sourcetype=X
| eval cust_id=$regid$
| top limit=1 cust_id</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <title>searching registration id: $regid$</title>
      <chart>
        <title>Title</title>
        <search>
          <query>index=Y sourcetype=Y Destination="*$regid$*" 
| timechart  span=5m max(Calls) by Cust_ID limit=0
| addtotals</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
          <refresh>10m</refresh>
          <refreshType>delay</refreshType>
        </search>
        <option name="charting.chart">column</option>
        <option name="charting.chart.showDataLabels">minmax</option>
        <option name="charting.drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </chart>
    </panel>
  </row>
  <row>
    <panel>
      <chart>
        <title>R-Factor</title>
        <search>
          <query>index=X sourcetype=X
| eval cust_id=$regid$
| rex field=cust_id mode=sed "s/(^30*)//1"
| where port==$cust_id$
| top limit=1 port</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
        </search>
        <option name="charting.chart">line</option>
        <option name="charting.drilldown">none</option>
        <option name="height">363</option>
        <option name="refresh.display">progressbar</option>
      </chart>
    </panel>
  </row>
  <row>
    <panel>
      <chart>
        <title>Title</title>
        <search>
          <query>index=Y sourcetype=Y Destination=$regid$ 
| timechart span=1d max(Calls) by Cust_ID
    | addtotals
    | fields Total
    | timechart span=1d max(Total)</query>
          <earliest>-30d@d</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.axisTitleX.visibility">collapsed</option>
        <option name="charting.chart">column</option>
        <option name="charting.chart.showDataLabels">all</option>
        <option name="charting.drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </chart>
    </panel>
  </row>
</form>

 

Dashboard screenshot:

Splunk dashboard.PNG

0 Karma
Get Updates on the Splunk Community!

CX Day is Coming!

Customer Experience (CX) Day is on October 7th!! We're so excited to bring back another day full of wonderful ...

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

The Big One: Splunk 10 is Here!  The moment many of you have been waiting for has arrived! We are thrilled to ...

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...