Dashboards & Visualizations

Dropdown missing something

mlevenson
Explorer

I have a drop down that will let a user select a host in order to view the cpu usage for a particluar time frame, however the search isn't working. I'm poking and proding but can't quite determine what I'm missing.

Here is my config -

<searchTemplate> host=%Server% counter="% Processor Time" | timechart avg(Value) by host</searchTemplate>

  <input type="dropdown" token="Server">
    <choice value="*">Any</choice>
       <populatingSearch fieldForValue="host" fieldForLabel="host">
        <![CDATA[host=%Server% counter="% Processor Time" | timechart avg(Value) by host]]>
       </populatingSearch>
</input>
  <input type="time"/>
  <default>Last 24hrs</default>  

The only value that shows up in the dropdown in the word "Any"

0 Karma

mlevenson
Explorer
<searchTemplate>host=$host$ counter="% Processor Time" | timechart avg(Value) by host</searchTemplate>

    <input type="dropdown" token="host" >
    <label>Select Server</label>
    <choice value="*">Any</choice>
       <populatingSearch fieldForValue="host" fieldForLabel="host">
        <![CDATA[ counter="% Processor Time" | stats count by host]]>
       </populatingSearch>

This ended up working, however it seems the populaing of the dropdown seems to take a while.

0 Karma

Masa
Splunk Employee
Splunk Employee
0 Karma

mlevenson
Explorer

I use the input type="time" to control what the search range is. Is that what you are refering to?

0 Karma

Masa
Splunk Employee
Splunk Employee

Can you limit the time range for the search?

0 Karma

Masa
Splunk Employee
Splunk Employee

That search output does not generate host feild. Check the output of the search. Try " stats count by host" and see if you can see a list of host in the dropdown.

0 Karma

Ayn
Legend

Why are you using the % character in your populatingSearch? Variable names are referred to by enclosing them in $ characters.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...