Dashboards & Visualizations

How do you make a graph in a dashboard run on a token input from a dropdown?

moizmmz
Path Finder

Hello, the image below shows the dashboard that I have created.

https://drive.google.com/file/d/1HGTJWHO78qoCdwdKhLebTM2ExRu0wmZT/view?usp=sharing
link text

The token of the Channel dropdown is called field3.

The graph below (named: DC Account Groups) is supposed to take the Channel input from the above dropdown and run the query to display results. But for some reason, even after selecting an input (channel in this case) from the dropdown, the graph still says: Waiting for input.

Here is the query i'm running in the graph:

index=uplynk slice_played | rex field=_raw "^(?<date>\S*)\s*(?<time>\S*)\s*(?<slice_played>\S*)\s*(?<assetID>\S*)\s*(?<sliceNumber>\S*)\s*(?<isLive>\S*)\s*(?<userIP>\S*)\s*(?<playerUserAgent>\S*)\s*(?<referrerURL>\S*)\s*(?<externalUserID>\S*)\s*(?<sessionID>\S*)\s*(?<playingOwnerID>\S*)\s*(?<channelID>\S*)\s*(?<eventID>\S*)\s*(?<duration>\S*)" | dedup channelID | search isLive=1 | lookup test.csv channelID OUTPUT channelID channelname accountgroup| search channelname="$field3$" | stats values(channelname)

The edit settings for the graph are in the image below:

https://drive.google.com/file/d/1vnySlPLHxLv5h6mnWgmLgoQz_6WhnENr/view?usp=sharing

Is there anything I should change there? Also, autorun dashboard is off.

Pls help ASAP.

Thanks

0 Karma
1 Solution

kmaron
Motivator

your token isn't working because it is in quotes search channelname="$field3$"

this should be search channelname=$field3$

If you need token value to be in quotes then add |s to the token like this search channelname=$field3|s$

View solution in original post

0 Karma

mstjohn_splunk
Splunk Employee
Splunk Employee

hi @moizmmz

Did the answer below solve your problem? If so, please resolve this post by approving it! If your problem is still not solved, keep us updated so that someone else can help ya. Thanks for posting!

0 Karma

moizmmz
Path Finder

Yep. Thanks!!

0 Karma

kmaron
Motivator

your token isn't working because it is in quotes search channelname="$field3$"

this should be search channelname=$field3$

If you need token value to be in quotes then add |s to the token like this search channelname=$field3|s$

0 Karma

moizmmz
Path Finder

Wow thanks!!

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...