Dashboards & Visualizations

How to edit my dashboard to get the condition statement to work properly?

jeffbat
Path Finder

I am having an issue with getting a dashboard panel to work properly based off multiple input fields being chosen.

Basically, I have a dashboard that has 3 input fields; Tier 1 App, Role, Counter. right now I just have 2 apps listed (Exchange & OLB), for Role it would be App/Service, DB, Web/UI, and for Counter it is CPU, Memory, Disk.

What I need to happen is a token is being set based on Tier 1 App and Role combined.

I have tried this but it is not working.

  <fieldset submitButton="true">
    <input type="dropdown" token="tier1app" searchWhenChanged="false">
      <label>Tier 1 App</label>
      <choice value="Exchange">Exchange</choice>
      <choice value="OLB">OLB</choice>
    </input>
    <input type="dropdown" token="role" searchWhenChanged="false">
      <label>Role</label>
      <choice value="App/Service">App/Service</choice>
      <choice value="DB">DB</choice>
      <choice value="Web/UI">Web/UI</choice>
      <change>
        <condition label="App/Service">
          <condition $tier1app$="OLB">
            <set token="tier1servers">("VMSVC01.INSIDE","VMSVC02.INSIDE","VMWEBSVC01.INSIDE","VMWEBSVC02.INSIDE")</set>
          </condition>
          <condition $tier1app$="Exchange">
            <set token="tier1servers">("EXCH01.INSIDE","EXCH02.INSIDE","EXCHAZ01.INSIDE","EXCHAZ02.INSIDE"")</set>
          </condition>
        </condition>
        <condition label="DB">
          <set token="tier1servers">("SQLOB01.INSIDE","SQLOB02.INSIDE","SQLF01.INSIDE","SQLF02.INSIDE")</set>
        </condition>
        <condition label="Web/UI">
          <set token="tier1servers">("CVMUI01.INSIDE","CVMUI02.INSIDE")</set>
        </condition>
      </change>
    </input>
    <input type="dropdown" token="counter" searchWhenChanged="false">
      <label>Counter</label>
      <choice value="CPU">CPU</choice>
      <choice value="Disk">Disk</choice>
      <choice value="Memory">Memory</choice>
      <change>
        <condition label="CPU">
          <set token="counterchoice">| where (CounterName="% Processor Time")</set>
        </condition>
        <condition label="Disk">
          <set token="counterchoice">| where (CounterName="% Disk Used")</set>
        </condition>
        <condition label="Memory">
          <set token="counterchoice">| where (CounterName="% Memory Used")</set>
        </condition>
      </change>
    </input>
  </fieldset>

When trying to do the match on the token (tier1app) from the first input and the role in the second one, when running it just sits there and says Search is waiting for input...

Anyone have any ideas how to get this setup to work?

0 Karma
1 Solution

niketn
Legend

Hi Please try the following, I have also changed a bit to get rid of Submit button and enable search on change instead(since tokens are being set on change events anyways). Also since there is a dependency between tier1app and role dropdowns, I am unsetting tokens for role dropdown and tier1servers on change of tier1app value. You can change accordingly for counter dropdown as well or remove these changes, if you need submit button.

  <fieldset submitButton="false">
    <input type="dropdown" token="tier1app" searchWhenChanged="true">
      <label>Tier 1 App</label>
      <choice value="Exchange">Exchange</choice>
      <choice value="OLB">OLB</choice>
      <change>
        <unset token="role"></unset>
        <unset token="form.role"></unset>
        <unset token="tier1servers"></unset>
      </change>
    </input>
    <input type="dropdown" token="role" searchWhenChanged="true">
      <label>Role</label>
      <choice value="App/Service">App/Service</choice>
      <choice value="DB">DB</choice>
      <choice value="Web/UI">Web/UI</choice>
      <change>
        <condition match="$label$=&quot;App/Service&quot; AND $tier1app$=&quot;OLB&quot;">
          <set token="tier1servers">("VMSVC01.INSIDE","VMSVC02.INSIDE","VMWEBSVC01.INSIDE","VMWEBSVC02.INSIDE")</set>
        </condition>
        <condition match="$label$=&quot;App/Service&quot; AND $tier1app$=&quot;Exchange&quot;">
          <set token="tier1servers">("EXCH01.INSIDE","EXCH02.INSIDE","EXCHAZ01.INSIDE","EXCHAZ02.INSIDE"")</set>
        </condition>
        <condition label="DB">
          <set token="tier1servers">("SQLOB01.INSIDE","SQLOB02.INSIDE","SQLF01.INSIDE","SQLF02.INSIDE")</set>
        </condition>
        <condition label="Web/UI">
          <set token="tier1servers">("CVMUI01.INSIDE","CVMUI02.INSIDE")</set>
        </condition>
      </change>
    </input>
    <input type="dropdown" token="counter" searchWhenChanged="true">
      <label>Counter</label>
      <choice value="CPU">CPU</choice>
      <choice value="Disk">Disk</choice>
      <choice value="Memory">Memory</choice>
      <change>
        <condition label="CPU">
          <set token="counterchoice">| where (CounterName="% Processor Time")</set>
        </condition>
        <condition label="Disk">
          <set token="counterchoice">| where (CounterName="% Disk Used")</set>
        </condition>
        <condition label="Memory">
          <set token="counterchoice">| where (CounterName="% Memory Used")</set>
        </condition>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <html>
        $tier1app$
        <br/>$role$</br>
        <br/>$tier1servers$</br>
        <br/>$counter$</br>
        <br/>$counterchoice$</br>
      </html>
    </panel>
  </row>

PS: Final HTML Panel added to test out token changes.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

niketn
Legend

Hi Please try the following, I have also changed a bit to get rid of Submit button and enable search on change instead(since tokens are being set on change events anyways). Also since there is a dependency between tier1app and role dropdowns, I am unsetting tokens for role dropdown and tier1servers on change of tier1app value. You can change accordingly for counter dropdown as well or remove these changes, if you need submit button.

  <fieldset submitButton="false">
    <input type="dropdown" token="tier1app" searchWhenChanged="true">
      <label>Tier 1 App</label>
      <choice value="Exchange">Exchange</choice>
      <choice value="OLB">OLB</choice>
      <change>
        <unset token="role"></unset>
        <unset token="form.role"></unset>
        <unset token="tier1servers"></unset>
      </change>
    </input>
    <input type="dropdown" token="role" searchWhenChanged="true">
      <label>Role</label>
      <choice value="App/Service">App/Service</choice>
      <choice value="DB">DB</choice>
      <choice value="Web/UI">Web/UI</choice>
      <change>
        <condition match="$label$=&quot;App/Service&quot; AND $tier1app$=&quot;OLB&quot;">
          <set token="tier1servers">("VMSVC01.INSIDE","VMSVC02.INSIDE","VMWEBSVC01.INSIDE","VMWEBSVC02.INSIDE")</set>
        </condition>
        <condition match="$label$=&quot;App/Service&quot; AND $tier1app$=&quot;Exchange&quot;">
          <set token="tier1servers">("EXCH01.INSIDE","EXCH02.INSIDE","EXCHAZ01.INSIDE","EXCHAZ02.INSIDE"")</set>
        </condition>
        <condition label="DB">
          <set token="tier1servers">("SQLOB01.INSIDE","SQLOB02.INSIDE","SQLF01.INSIDE","SQLF02.INSIDE")</set>
        </condition>
        <condition label="Web/UI">
          <set token="tier1servers">("CVMUI01.INSIDE","CVMUI02.INSIDE")</set>
        </condition>
      </change>
    </input>
    <input type="dropdown" token="counter" searchWhenChanged="true">
      <label>Counter</label>
      <choice value="CPU">CPU</choice>
      <choice value="Disk">Disk</choice>
      <choice value="Memory">Memory</choice>
      <change>
        <condition label="CPU">
          <set token="counterchoice">| where (CounterName="% Processor Time")</set>
        </condition>
        <condition label="Disk">
          <set token="counterchoice">| where (CounterName="% Disk Used")</set>
        </condition>
        <condition label="Memory">
          <set token="counterchoice">| where (CounterName="% Memory Used")</set>
        </condition>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <html>
        $tier1app$
        <br/>$role$</br>
        <br/>$tier1servers$</br>
        <br/>$counter$</br>
        <br/>$counterchoice$</br>
      </html>
    </panel>
  </row>

PS: Final HTML Panel added to test out token changes.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...