Dashboards & Visualizations

Dashboard search waiting for input while token is present

pvdijssel
Engager

Hi,

I got this dashboard in which I work with tokens to select specific customer data. By selecting the correct customer, the drop down menu pushes a customer number (formatted like 30001, 30002,... 30999) to all searches within the dashboard. This is working flawless.

Now I created a new search within that same dashboard that only uses the trailing number (1,2, ... 999). If I test this in a normal search by pushing the customer id via an eval into the cust_id field it works. But the same search with tokens in a dashboards returns the error "wating on input". Can't debug it either because there is no sid.

 

Working search:

 

index=x sourcetype=x 
| eval regid=30001
| eval cust_id=$regid$
| rex field=cust_id mode=sed "s/(^30*)//1"
| where port==$cust_id$
| top limit=1 port

 

 

NOT working dashboard search:

 

index=x sourcetype=x 
| eval cust_id=$regid$
| rex field=cust_id mode=sed "s/(^30*)//1"
| where port==$cust_id$
| top limit=1 port

 

 

 

Labels (1)
0 Karma

jhanvidattani
Path Finder

Can you share dashboard code with inputs and 1/2 panels? So, it would be easy to debug further.

0 Karma

pvdijssel
Engager

Dashboard code:

<form theme="light">
  <label>Customer Dashboard (Clone)</label>
  <fieldset submitButton="true" autoRun="false">
    <input type="dropdown" token="regid" searchWhenChanged="false">
      <label>Customer</label>
      <choice value="30001">Customer X (1)</choice>
      <choice value="30023">Customer Y (23)</choice>
      <choice value="30097">Customer Z (97)</choice>
      <search>
        <query/>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
    </input>
    <input type="time" token="field1">
      <label></label>
      <default>
        <earliest>-60m@m</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <title>TEST regid: $regid$</title>
        <search>
          <query>index=X sourcetype=X
| eval cust_id=$regid$
| top limit=1 cust_id</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <title>searching registration id: $regid$</title>
      <chart>
        <title>Title</title>
        <search>
          <query>index=Y sourcetype=Y Destination="*$regid$*" 
| timechart  span=5m max(Calls) by Cust_ID limit=0
| addtotals</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
          <refresh>10m</refresh>
          <refreshType>delay</refreshType>
        </search>
        <option name="charting.chart">column</option>
        <option name="charting.chart.showDataLabels">minmax</option>
        <option name="charting.drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </chart>
    </panel>
  </row>
  <row>
    <panel>
      <chart>
        <title>R-Factor</title>
        <search>
          <query>index=X sourcetype=X
| eval cust_id=$regid$
| rex field=cust_id mode=sed "s/(^30*)//1"
| where port==$cust_id$
| top limit=1 port</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
        </search>
        <option name="charting.chart">line</option>
        <option name="charting.drilldown">none</option>
        <option name="height">363</option>
        <option name="refresh.display">progressbar</option>
      </chart>
    </panel>
  </row>
  <row>
    <panel>
      <chart>
        <title>Title</title>
        <search>
          <query>index=Y sourcetype=Y Destination=$regid$ 
| timechart span=1d max(Calls) by Cust_ID
    | addtotals
    | fields Total
    | timechart span=1d max(Total)</query>
          <earliest>-30d@d</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.axisTitleX.visibility">collapsed</option>
        <option name="charting.chart">column</option>
        <option name="charting.chart.showDataLabels">all</option>
        <option name="charting.drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </chart>
    </panel>
  </row>
</form>

 

Dashboard screenshot:

Splunk dashboard.PNG

0 Karma
Get Updates on the Splunk Community!

What’s New & Next in Splunk SOAR

Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us on ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...