Dashboards & Visualizations

How do I fix my multiselect so that it works for one metric tag?

walkerhound
Path Finder

I am using a multiselect input to create a query of the metrics store. If there is one metric_name chosen, the resulting token looks like this:

(metric_name="myMetricName")

If two metric_names are chosen the resulting token looks like this:

(metric_name="myMetricName1" OR metric_name="myMetricName2")

The search looks like this:

|mstats prestats=true avg(_value) WHERE $myToken$
                        index="myMetricsIndex" span=1m  BY metric_name
                        |timechart span=1m avg(_value) by metric_name

This search works for two metric_names but not for one metric_name.

I have two questions.

First: Why is the following search illegal?

|mstats prestats=true avg(_value) WHERE (metric_name="myMetricName")
                        index="myMetricsIndex" span=1m  BY metric_name
                        |timechart span=1m avg(_value) by metric_name

Secondly: How to I fix my multiselect so that it works for one metric tag?

0 Karma

niketn
Legend

@walkerhound, can you try the following approach?

Have your multi-value input prepare values like "myMetricName1"when 1 metric is selected and "myMetricName1","myMetricName2" when two metrics are selected.

| mstats prestats=t avg(_value) WHERE index="myMetricsIndex" AND metric_name IN ( $myToken$ ) 
                          span=1m BY metrics_name
                         |timechart span=1m avg(_value) by metric_name

Also while debugging display $myToken$ in the <panel> <title> to test the token value i.e.

<title>$mytoken$</title>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

walkerhound
Path Finder

I just discovered that adding a space after the ( works with one metric_name as well as two metric_names.

I still wonder why the original syntax is illegal.

0 Karma

p_gurav
Champion

Can you avoid putting token without brackets?

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...