Dashboards & Visualizations

How do I fix my multiselect so that it works for one metric tag?

walkerhound
Path Finder

I am using a multiselect input to create a query of the metrics store. If there is one metric_name chosen, the resulting token looks like this:

(metric_name="myMetricName")

If two metric_names are chosen the resulting token looks like this:

(metric_name="myMetricName1" OR metric_name="myMetricName2")

The search looks like this:

|mstats prestats=true avg(_value) WHERE $myToken$
                        index="myMetricsIndex" span=1m  BY metric_name
                        |timechart span=1m avg(_value) by metric_name

This search works for two metric_names but not for one metric_name.

I have two questions.

First: Why is the following search illegal?

|mstats prestats=true avg(_value) WHERE (metric_name="myMetricName")
                        index="myMetricsIndex" span=1m  BY metric_name
                        |timechart span=1m avg(_value) by metric_name

Secondly: How to I fix my multiselect so that it works for one metric tag?

0 Karma

niketn
Legend

@walkerhound, can you try the following approach?

Have your multi-value input prepare values like "myMetricName1"when 1 metric is selected and "myMetricName1","myMetricName2" when two metrics are selected.

| mstats prestats=t avg(_value) WHERE index="myMetricsIndex" AND metric_name IN ( $myToken$ ) 
                          span=1m BY metrics_name
                         |timechart span=1m avg(_value) by metric_name

Also while debugging display $myToken$ in the <panel> <title> to test the token value i.e.

<title>$mytoken$</title>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

walkerhound
Path Finder

I just discovered that adding a space after the ( works with one metric_name as well as two metric_names.

I still wonder why the original syntax is illegal.

0 Karma

p_gurav
Champion

Can you avoid putting token without brackets?

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...