Dashboards & Visualizations

How do you make a graph in a dashboard run on a token input from a dropdown?

moizmmz
Path Finder

Hello, the image below shows the dashboard that I have created.

https://drive.google.com/file/d/1HGTJWHO78qoCdwdKhLebTM2ExRu0wmZT/view?usp=sharing
link text

The token of the Channel dropdown is called field3.

The graph below (named: DC Account Groups) is supposed to take the Channel input from the above dropdown and run the query to display results. But for some reason, even after selecting an input (channel in this case) from the dropdown, the graph still says: Waiting for input.

Here is the query i'm running in the graph:

index=uplynk slice_played | rex field=_raw "^(?<date>\S*)\s*(?<time>\S*)\s*(?<slice_played>\S*)\s*(?<assetID>\S*)\s*(?<sliceNumber>\S*)\s*(?<isLive>\S*)\s*(?<userIP>\S*)\s*(?<playerUserAgent>\S*)\s*(?<referrerURL>\S*)\s*(?<externalUserID>\S*)\s*(?<sessionID>\S*)\s*(?<playingOwnerID>\S*)\s*(?<channelID>\S*)\s*(?<eventID>\S*)\s*(?<duration>\S*)" | dedup channelID | search isLive=1 | lookup test.csv channelID OUTPUT channelID channelname accountgroup| search channelname="$field3$" | stats values(channelname)

The edit settings for the graph are in the image below:

https://drive.google.com/file/d/1vnySlPLHxLv5h6mnWgmLgoQz_6WhnENr/view?usp=sharing

Is there anything I should change there? Also, autorun dashboard is off.

Pls help ASAP.

Thanks

0 Karma
1 Solution

kmaron
Motivator

your token isn't working because it is in quotes search channelname="$field3$"

this should be search channelname=$field3$

If you need token value to be in quotes then add |s to the token like this search channelname=$field3|s$

View solution in original post

0 Karma

mstjohn_splunk
Splunk Employee
Splunk Employee

hi @moizmmz

Did the answer below solve your problem? If so, please resolve this post by approving it! If your problem is still not solved, keep us updated so that someone else can help ya. Thanks for posting!

0 Karma

moizmmz
Path Finder

Yep. Thanks!!

0 Karma

kmaron
Motivator

your token isn't working because it is in quotes search channelname="$field3$"

this should be search channelname=$field3$

If you need token value to be in quotes then add |s to the token like this search channelname=$field3|s$

0 Karma

moizmmz
Path Finder

Wow thanks!!

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...