Dashboards & Visualizations

How do you make a graph in a dashboard run on a token input from a dropdown?

moizmmz
Path Finder

Hello, the image below shows the dashboard that I have created.

https://drive.google.com/file/d/1HGTJWHO78qoCdwdKhLebTM2ExRu0wmZT/view?usp=sharing
link text

The token of the Channel dropdown is called field3.

The graph below (named: DC Account Groups) is supposed to take the Channel input from the above dropdown and run the query to display results. But for some reason, even after selecting an input (channel in this case) from the dropdown, the graph still says: Waiting for input.

Here is the query i'm running in the graph:

index=uplynk slice_played | rex field=_raw "^(?<date>\S*)\s*(?<time>\S*)\s*(?<slice_played>\S*)\s*(?<assetID>\S*)\s*(?<sliceNumber>\S*)\s*(?<isLive>\S*)\s*(?<userIP>\S*)\s*(?<playerUserAgent>\S*)\s*(?<referrerURL>\S*)\s*(?<externalUserID>\S*)\s*(?<sessionID>\S*)\s*(?<playingOwnerID>\S*)\s*(?<channelID>\S*)\s*(?<eventID>\S*)\s*(?<duration>\S*)" | dedup channelID | search isLive=1 | lookup test.csv channelID OUTPUT channelID channelname accountgroup| search channelname="$field3$" | stats values(channelname)

The edit settings for the graph are in the image below:

https://drive.google.com/file/d/1vnySlPLHxLv5h6mnWgmLgoQz_6WhnENr/view?usp=sharing

Is there anything I should change there? Also, autorun dashboard is off.

Pls help ASAP.

Thanks

0 Karma
1 Solution

kmaron
Motivator

your token isn't working because it is in quotes search channelname="$field3$"

this should be search channelname=$field3$

If you need token value to be in quotes then add |s to the token like this search channelname=$field3|s$

View solution in original post

0 Karma

mstjohn_splunk
Splunk Employee
Splunk Employee

hi @moizmmz

Did the answer below solve your problem? If so, please resolve this post by approving it! If your problem is still not solved, keep us updated so that someone else can help ya. Thanks for posting!

0 Karma

moizmmz
Path Finder

Yep. Thanks!!

0 Karma

kmaron
Motivator

your token isn't working because it is in quotes search channelname="$field3$"

this should be search channelname=$field3$

If you need token value to be in quotes then add |s to the token like this search channelname=$field3|s$

0 Karma

moizmmz
Path Finder

Wow thanks!!

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...