Dashboards & Visualizations

How to edit my dashboard to get the condition statement to work properly?

jeffbat
Path Finder

I am having an issue with getting a dashboard panel to work properly based off multiple input fields being chosen.

Basically, I have a dashboard that has 3 input fields; Tier 1 App, Role, Counter. right now I just have 2 apps listed (Exchange & OLB), for Role it would be App/Service, DB, Web/UI, and for Counter it is CPU, Memory, Disk.

What I need to happen is a token is being set based on Tier 1 App and Role combined.

I have tried this but it is not working.

  <fieldset submitButton="true">
    <input type="dropdown" token="tier1app" searchWhenChanged="false">
      <label>Tier 1 App</label>
      <choice value="Exchange">Exchange</choice>
      <choice value="OLB">OLB</choice>
    </input>
    <input type="dropdown" token="role" searchWhenChanged="false">
      <label>Role</label>
      <choice value="App/Service">App/Service</choice>
      <choice value="DB">DB</choice>
      <choice value="Web/UI">Web/UI</choice>
      <change>
        <condition label="App/Service">
          <condition $tier1app$="OLB">
            <set token="tier1servers">("VMSVC01.INSIDE","VMSVC02.INSIDE","VMWEBSVC01.INSIDE","VMWEBSVC02.INSIDE")</set>
          </condition>
          <condition $tier1app$="Exchange">
            <set token="tier1servers">("EXCH01.INSIDE","EXCH02.INSIDE","EXCHAZ01.INSIDE","EXCHAZ02.INSIDE"")</set>
          </condition>
        </condition>
        <condition label="DB">
          <set token="tier1servers">("SQLOB01.INSIDE","SQLOB02.INSIDE","SQLF01.INSIDE","SQLF02.INSIDE")</set>
        </condition>
        <condition label="Web/UI">
          <set token="tier1servers">("CVMUI01.INSIDE","CVMUI02.INSIDE")</set>
        </condition>
      </change>
    </input>
    <input type="dropdown" token="counter" searchWhenChanged="false">
      <label>Counter</label>
      <choice value="CPU">CPU</choice>
      <choice value="Disk">Disk</choice>
      <choice value="Memory">Memory</choice>
      <change>
        <condition label="CPU">
          <set token="counterchoice">| where (CounterName="% Processor Time")</set>
        </condition>
        <condition label="Disk">
          <set token="counterchoice">| where (CounterName="% Disk Used")</set>
        </condition>
        <condition label="Memory">
          <set token="counterchoice">| where (CounterName="% Memory Used")</set>
        </condition>
      </change>
    </input>
  </fieldset>

When trying to do the match on the token (tier1app) from the first input and the role in the second one, when running it just sits there and says Search is waiting for input...

Anyone have any ideas how to get this setup to work?

0 Karma
1 Solution

niketn
Legend

Hi Please try the following, I have also changed a bit to get rid of Submit button and enable search on change instead(since tokens are being set on change events anyways). Also since there is a dependency between tier1app and role dropdowns, I am unsetting tokens for role dropdown and tier1servers on change of tier1app value. You can change accordingly for counter dropdown as well or remove these changes, if you need submit button.

  <fieldset submitButton="false">
    <input type="dropdown" token="tier1app" searchWhenChanged="true">
      <label>Tier 1 App</label>
      <choice value="Exchange">Exchange</choice>
      <choice value="OLB">OLB</choice>
      <change>
        <unset token="role"></unset>
        <unset token="form.role"></unset>
        <unset token="tier1servers"></unset>
      </change>
    </input>
    <input type="dropdown" token="role" searchWhenChanged="true">
      <label>Role</label>
      <choice value="App/Service">App/Service</choice>
      <choice value="DB">DB</choice>
      <choice value="Web/UI">Web/UI</choice>
      <change>
        <condition match="$label$=&quot;App/Service&quot; AND $tier1app$=&quot;OLB&quot;">
          <set token="tier1servers">("VMSVC01.INSIDE","VMSVC02.INSIDE","VMWEBSVC01.INSIDE","VMWEBSVC02.INSIDE")</set>
        </condition>
        <condition match="$label$=&quot;App/Service&quot; AND $tier1app$=&quot;Exchange&quot;">
          <set token="tier1servers">("EXCH01.INSIDE","EXCH02.INSIDE","EXCHAZ01.INSIDE","EXCHAZ02.INSIDE"")</set>
        </condition>
        <condition label="DB">
          <set token="tier1servers">("SQLOB01.INSIDE","SQLOB02.INSIDE","SQLF01.INSIDE","SQLF02.INSIDE")</set>
        </condition>
        <condition label="Web/UI">
          <set token="tier1servers">("CVMUI01.INSIDE","CVMUI02.INSIDE")</set>
        </condition>
      </change>
    </input>
    <input type="dropdown" token="counter" searchWhenChanged="true">
      <label>Counter</label>
      <choice value="CPU">CPU</choice>
      <choice value="Disk">Disk</choice>
      <choice value="Memory">Memory</choice>
      <change>
        <condition label="CPU">
          <set token="counterchoice">| where (CounterName="% Processor Time")</set>
        </condition>
        <condition label="Disk">
          <set token="counterchoice">| where (CounterName="% Disk Used")</set>
        </condition>
        <condition label="Memory">
          <set token="counterchoice">| where (CounterName="% Memory Used")</set>
        </condition>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <html>
        $tier1app$
        <br/>$role$</br>
        <br/>$tier1servers$</br>
        <br/>$counter$</br>
        <br/>$counterchoice$</br>
      </html>
    </panel>
  </row>

PS: Final HTML Panel added to test out token changes.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

niketn
Legend

Hi Please try the following, I have also changed a bit to get rid of Submit button and enable search on change instead(since tokens are being set on change events anyways). Also since there is a dependency between tier1app and role dropdowns, I am unsetting tokens for role dropdown and tier1servers on change of tier1app value. You can change accordingly for counter dropdown as well or remove these changes, if you need submit button.

  <fieldset submitButton="false">
    <input type="dropdown" token="tier1app" searchWhenChanged="true">
      <label>Tier 1 App</label>
      <choice value="Exchange">Exchange</choice>
      <choice value="OLB">OLB</choice>
      <change>
        <unset token="role"></unset>
        <unset token="form.role"></unset>
        <unset token="tier1servers"></unset>
      </change>
    </input>
    <input type="dropdown" token="role" searchWhenChanged="true">
      <label>Role</label>
      <choice value="App/Service">App/Service</choice>
      <choice value="DB">DB</choice>
      <choice value="Web/UI">Web/UI</choice>
      <change>
        <condition match="$label$=&quot;App/Service&quot; AND $tier1app$=&quot;OLB&quot;">
          <set token="tier1servers">("VMSVC01.INSIDE","VMSVC02.INSIDE","VMWEBSVC01.INSIDE","VMWEBSVC02.INSIDE")</set>
        </condition>
        <condition match="$label$=&quot;App/Service&quot; AND $tier1app$=&quot;Exchange&quot;">
          <set token="tier1servers">("EXCH01.INSIDE","EXCH02.INSIDE","EXCHAZ01.INSIDE","EXCHAZ02.INSIDE"")</set>
        </condition>
        <condition label="DB">
          <set token="tier1servers">("SQLOB01.INSIDE","SQLOB02.INSIDE","SQLF01.INSIDE","SQLF02.INSIDE")</set>
        </condition>
        <condition label="Web/UI">
          <set token="tier1servers">("CVMUI01.INSIDE","CVMUI02.INSIDE")</set>
        </condition>
      </change>
    </input>
    <input type="dropdown" token="counter" searchWhenChanged="true">
      <label>Counter</label>
      <choice value="CPU">CPU</choice>
      <choice value="Disk">Disk</choice>
      <choice value="Memory">Memory</choice>
      <change>
        <condition label="CPU">
          <set token="counterchoice">| where (CounterName="% Processor Time")</set>
        </condition>
        <condition label="Disk">
          <set token="counterchoice">| where (CounterName="% Disk Used")</set>
        </condition>
        <condition label="Memory">
          <set token="counterchoice">| where (CounterName="% Memory Used")</set>
        </condition>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <html>
        $tier1app$
        <br/>$role$</br>
        <br/>$tier1servers$</br>
        <br/>$counter$</br>
        <br/>$counterchoice$</br>
      </html>
    </panel>
  </row>

PS: Final HTML Panel added to test out token changes.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...