Dashboards & Visualizations

How do you make a graph in a dashboard run on a token input from a dropdown?

moizmmz
Path Finder

Hello, the image below shows the dashboard that I have created.

https://drive.google.com/file/d/1HGTJWHO78qoCdwdKhLebTM2ExRu0wmZT/view?usp=sharing
link text

The token of the Channel dropdown is called field3.

The graph below (named: DC Account Groups) is supposed to take the Channel input from the above dropdown and run the query to display results. But for some reason, even after selecting an input (channel in this case) from the dropdown, the graph still says: Waiting for input.

Here is the query i'm running in the graph:

index=uplynk slice_played | rex field=_raw "^(?<date>\S*)\s*(?<time>\S*)\s*(?<slice_played>\S*)\s*(?<assetID>\S*)\s*(?<sliceNumber>\S*)\s*(?<isLive>\S*)\s*(?<userIP>\S*)\s*(?<playerUserAgent>\S*)\s*(?<referrerURL>\S*)\s*(?<externalUserID>\S*)\s*(?<sessionID>\S*)\s*(?<playingOwnerID>\S*)\s*(?<channelID>\S*)\s*(?<eventID>\S*)\s*(?<duration>\S*)" | dedup channelID | search isLive=1 | lookup test.csv channelID OUTPUT channelID channelname accountgroup| search channelname="$field3$" | stats values(channelname)

The edit settings for the graph are in the image below:

https://drive.google.com/file/d/1vnySlPLHxLv5h6mnWgmLgoQz_6WhnENr/view?usp=sharing

Is there anything I should change there? Also, autorun dashboard is off.

Pls help ASAP.

Thanks

0 Karma
1 Solution

kmaron
Motivator

your token isn't working because it is in quotes search channelname="$field3$"

this should be search channelname=$field3$

If you need token value to be in quotes then add |s to the token like this search channelname=$field3|s$

View solution in original post

0 Karma

mstjohn_splunk
Splunk Employee
Splunk Employee

hi @moizmmz

Did the answer below solve your problem? If so, please resolve this post by approving it! If your problem is still not solved, keep us updated so that someone else can help ya. Thanks for posting!

0 Karma

moizmmz
Path Finder

Yep. Thanks!!

0 Karma

kmaron
Motivator

your token isn't working because it is in quotes search channelname="$field3$"

this should be search channelname=$field3$

If you need token value to be in quotes then add |s to the token like this search channelname=$field3|s$

0 Karma

moizmmz
Path Finder

Wow thanks!!

0 Karma
Get Updates on the Splunk Community!

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...

Announcing the Migration of the Splunk Add-on for Microsoft Azure Inputs to ...

Announcing the Migration of the Splunk Add-on for Microsoft Azure Inputs to Officially Supported Splunk ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI! Discover how Splunk’s agentic AI ...