Dashboards & Visualizations
Highlighted

Dropdown missing something

Explorer

I have a drop down that will let a user select a host in order to view the cpu usage for a particluar time frame, however the search isn't working. I'm poking and proding but can't quite determine what I'm missing.

Here is my config -

<searchTemplate> host=%Server% counter="% Processor Time" | timechart avg(Value) by host</searchTemplate>

  <input type="dropdown" token="Server">
    <choice value="*">Any</choice>
       <populatingSearch fieldForValue="host" fieldForLabel="host">
        <![CDATA[host=%Server% counter="% Processor Time" | timechart avg(Value) by host]]>
       </populatingSearch>
</input>
  <input type="time"/>
  <default>Last 24hrs</default>  

The only value that shows up in the dropdown in the word "Any"

0 Karma
Highlighted

Re: Dropdown missing something

Legend

Why are you using the % character in your populatingSearch? Variable names are referred to by enclosing them in $ characters.

0 Karma
Highlighted

Re: Dropdown missing something

Splunk Employee
Splunk Employee

That search output does not generate host feild. Check the output of the search. Try " stats count by host" and see if you can see a list of host in the dropdown.

0 Karma
Highlighted

Re: Dropdown missing something

Explorer
<searchTemplate>host=$host$ counter="% Processor Time" | timechart avg(Value) by host</searchTemplate>

    <input type="dropdown" token="host" >
    <label>Select Server</label>
    <choice value="*">Any</choice>
       <populatingSearch fieldForValue="host" fieldForLabel="host">
        <![CDATA[ counter="% Processor Time" | stats count by host]]>
       </populatingSearch>

This ended up working, however it seems the populaing of the dropdown seems to take a while.

0 Karma
Highlighted

Re: Dropdown missing something

Splunk Employee
Splunk Employee

Can you limit the time range for the search?

0 Karma
Highlighted

Re: Dropdown missing something

Explorer

I use the input type="time" to control what the search range is. Is that what you are refering to?

0 Karma
Highlighted

Re: Dropdown missing something

Splunk Employee
Splunk Employee
0 Karma