High Refresh is causing Splunk not to assign token correctly

[robertlynch2020]

Hi 

I think I have found a bug in Splunk!!

I have a table like below, I need to click on different columns and for different actions to happen (drill-down).

I have noticed because I have a 5-second refresh rate on the table when a user clicks on the column the tokens get set 80% of the time and the other 20% value of "null" is set.  Is there a workaround for this I am on 8.2.0.

When I changed the refresh to 60 seconds it works all the time, when I put it a 1 second, it never works.

The process_serviceName token can get set to the correct value 80% of the time, but "null" can be added to the other 20%.

<eval token="process_serviceName">mvindex(split($row.service_name$," # "),0)</eval>

I have other columns that work fine, but i think as i am doing a calculation on the value this is why it is not working.

 <condition match="$click.name2$==&quot;Process_Name&quot; AND ($row.Service_type$==&quot;agent-based&quot; OR $row.Service_type$==&quot;launcher-based&quot;)">
            <!--set token="process_serviceName">$row.service_name$</set-->
			<eval token="process_serviceName">mvindex(split($row.service_name$," # "),0)</eval>	
            <set token="pid_clicked">$row.PID$</set>
            <set token="launcher_name_set_from_process_token">*</set>
			<unset token="Process_historic_graph"></unset>
			<unset token="Health_Token"></unset>
			<unset token="Resources_Token"></unset>
			<unset token="Java_Token"></unset>
          </condition>

[robertlynch2020 · Accepted solution]

Hi

Yes, i agree the 5 seconds is a lot, but businesses are driving that one.

I did find a workaround. 

Instead of 

<eval token="process_serviceName">mvindex(split($row.service_name$," # "),0)</eval>

I was able to display it directly in the table and set the token, it seems to always work now.

<set token="process_serviceName">$row.service_name$</set>

Thanks for your comments

[richgalloway]

Rather than find a bug, I think you've made a good case against refreshing dashboards too often.  🙂  It would seem tokens are cleared when the dashboard refreshes and that is why drilldown fails.  The less frequently the dashboard refreshes, the lower the chances of failure.

Remember, every time the dashboard refreshes, every search in the dashboard runs again - consuming resources and possibly preventing other searches from running.  Ask yourself what information users will get in 5 seconds that they won't get in 30 or 60 seconds and what will they do with that information.

[robertlynch2020]

Hi

Yes, i agree the 5 seconds is a lot, but businesses are driving that one.

I did find a workaround. 

Instead of 

<eval token="process_serviceName">mvindex(split($row.service_name$," # "),0)</eval>

I was able to display it directly in the table and set the token, it seems to always work now.

<set token="process_serviceName">$row.service_name$</set>

Thanks for your comments