Dashboards & Visualizations

How do you make a graph in a dashboard run on a token input from a dropdown?

moizmmz
Path Finder

Hello, the image below shows the dashboard that I have created.

https://drive.google.com/file/d/1HGTJWHO78qoCdwdKhLebTM2ExRu0wmZT/view?usp=sharing
link text

The token of the Channel dropdown is called field3.

The graph below (named: DC Account Groups) is supposed to take the Channel input from the above dropdown and run the query to display results. But for some reason, even after selecting an input (channel in this case) from the dropdown, the graph still says: Waiting for input.

Here is the query i'm running in the graph:

index=uplynk slice_played | rex field=_raw "^(?<date>\S*)\s*(?<time>\S*)\s*(?<slice_played>\S*)\s*(?<assetID>\S*)\s*(?<sliceNumber>\S*)\s*(?<isLive>\S*)\s*(?<userIP>\S*)\s*(?<playerUserAgent>\S*)\s*(?<referrerURL>\S*)\s*(?<externalUserID>\S*)\s*(?<sessionID>\S*)\s*(?<playingOwnerID>\S*)\s*(?<channelID>\S*)\s*(?<eventID>\S*)\s*(?<duration>\S*)" | dedup channelID | search isLive=1 | lookup test.csv channelID OUTPUT channelID channelname accountgroup| search channelname="$field3$" | stats values(channelname)

The edit settings for the graph are in the image below:

https://drive.google.com/file/d/1vnySlPLHxLv5h6mnWgmLgoQz_6WhnENr/view?usp=sharing

Is there anything I should change there? Also, autorun dashboard is off.

Pls help ASAP.

Thanks

0 Karma
1 Solution

kmaron
Motivator

your token isn't working because it is in quotes search channelname="$field3$"

this should be search channelname=$field3$

If you need token value to be in quotes then add |s to the token like this search channelname=$field3|s$

View solution in original post

0 Karma

mstjohn_splunk
Splunk Employee
Splunk Employee

hi @moizmmz

Did the answer below solve your problem? If so, please resolve this post by approving it! If your problem is still not solved, keep us updated so that someone else can help ya. Thanks for posting!

0 Karma

moizmmz
Path Finder

Yep. Thanks!!

0 Karma

kmaron
Motivator

your token isn't working because it is in quotes search channelname="$field3$"

this should be search channelname=$field3$

If you need token value to be in quotes then add |s to the token like this search channelname=$field3|s$

0 Karma

moizmmz
Path Finder

Wow thanks!!

0 Karma
Get Updates on the Splunk Community!

CX Day is Coming!

Customer Experience (CX) Day is on October 7th!! We're so excited to bring back another day full of wonderful ...

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

The Big One: Splunk 10 is Here!  The moment many of you have been waiting for has arrived! We are thrilled to ...

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...