Dashboards & Visualizations

How to edit my dashboard to get the condition statement to work properly?

jeffbat
Path Finder

I am having an issue with getting a dashboard panel to work properly based off multiple input fields being chosen.

Basically, I have a dashboard that has 3 input fields; Tier 1 App, Role, Counter. right now I just have 2 apps listed (Exchange & OLB), for Role it would be App/Service, DB, Web/UI, and for Counter it is CPU, Memory, Disk.

What I need to happen is a token is being set based on Tier 1 App and Role combined.

I have tried this but it is not working.

  <fieldset submitButton="true">
    <input type="dropdown" token="tier1app" searchWhenChanged="false">
      <label>Tier 1 App</label>
      <choice value="Exchange">Exchange</choice>
      <choice value="OLB">OLB</choice>
    </input>
    <input type="dropdown" token="role" searchWhenChanged="false">
      <label>Role</label>
      <choice value="App/Service">App/Service</choice>
      <choice value="DB">DB</choice>
      <choice value="Web/UI">Web/UI</choice>
      <change>
        <condition label="App/Service">
          <condition $tier1app$="OLB">
            <set token="tier1servers">("VMSVC01.INSIDE","VMSVC02.INSIDE","VMWEBSVC01.INSIDE","VMWEBSVC02.INSIDE")</set>
          </condition>
          <condition $tier1app$="Exchange">
            <set token="tier1servers">("EXCH01.INSIDE","EXCH02.INSIDE","EXCHAZ01.INSIDE","EXCHAZ02.INSIDE"")</set>
          </condition>
        </condition>
        <condition label="DB">
          <set token="tier1servers">("SQLOB01.INSIDE","SQLOB02.INSIDE","SQLF01.INSIDE","SQLF02.INSIDE")</set>
        </condition>
        <condition label="Web/UI">
          <set token="tier1servers">("CVMUI01.INSIDE","CVMUI02.INSIDE")</set>
        </condition>
      </change>
    </input>
    <input type="dropdown" token="counter" searchWhenChanged="false">
      <label>Counter</label>
      <choice value="CPU">CPU</choice>
      <choice value="Disk">Disk</choice>
      <choice value="Memory">Memory</choice>
      <change>
        <condition label="CPU">
          <set token="counterchoice">| where (CounterName="% Processor Time")</set>
        </condition>
        <condition label="Disk">
          <set token="counterchoice">| where (CounterName="% Disk Used")</set>
        </condition>
        <condition label="Memory">
          <set token="counterchoice">| where (CounterName="% Memory Used")</set>
        </condition>
      </change>
    </input>
  </fieldset>

When trying to do the match on the token (tier1app) from the first input and the role in the second one, when running it just sits there and says Search is waiting for input...

Anyone have any ideas how to get this setup to work?

0 Karma
1 Solution

niketn
Legend

Hi Please try the following, I have also changed a bit to get rid of Submit button and enable search on change instead(since tokens are being set on change events anyways). Also since there is a dependency between tier1app and role dropdowns, I am unsetting tokens for role dropdown and tier1servers on change of tier1app value. You can change accordingly for counter dropdown as well or remove these changes, if you need submit button.

  <fieldset submitButton="false">
    <input type="dropdown" token="tier1app" searchWhenChanged="true">
      <label>Tier 1 App</label>
      <choice value="Exchange">Exchange</choice>
      <choice value="OLB">OLB</choice>
      <change>
        <unset token="role"></unset>
        <unset token="form.role"></unset>
        <unset token="tier1servers"></unset>
      </change>
    </input>
    <input type="dropdown" token="role" searchWhenChanged="true">
      <label>Role</label>
      <choice value="App/Service">App/Service</choice>
      <choice value="DB">DB</choice>
      <choice value="Web/UI">Web/UI</choice>
      <change>
        <condition match="$label$=&quot;App/Service&quot; AND $tier1app$=&quot;OLB&quot;">
          <set token="tier1servers">("VMSVC01.INSIDE","VMSVC02.INSIDE","VMWEBSVC01.INSIDE","VMWEBSVC02.INSIDE")</set>
        </condition>
        <condition match="$label$=&quot;App/Service&quot; AND $tier1app$=&quot;Exchange&quot;">
          <set token="tier1servers">("EXCH01.INSIDE","EXCH02.INSIDE","EXCHAZ01.INSIDE","EXCHAZ02.INSIDE"")</set>
        </condition>
        <condition label="DB">
          <set token="tier1servers">("SQLOB01.INSIDE","SQLOB02.INSIDE","SQLF01.INSIDE","SQLF02.INSIDE")</set>
        </condition>
        <condition label="Web/UI">
          <set token="tier1servers">("CVMUI01.INSIDE","CVMUI02.INSIDE")</set>
        </condition>
      </change>
    </input>
    <input type="dropdown" token="counter" searchWhenChanged="true">
      <label>Counter</label>
      <choice value="CPU">CPU</choice>
      <choice value="Disk">Disk</choice>
      <choice value="Memory">Memory</choice>
      <change>
        <condition label="CPU">
          <set token="counterchoice">| where (CounterName="% Processor Time")</set>
        </condition>
        <condition label="Disk">
          <set token="counterchoice">| where (CounterName="% Disk Used")</set>
        </condition>
        <condition label="Memory">
          <set token="counterchoice">| where (CounterName="% Memory Used")</set>
        </condition>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <html>
        $tier1app$
        <br/>$role$</br>
        <br/>$tier1servers$</br>
        <br/>$counter$</br>
        <br/>$counterchoice$</br>
      </html>
    </panel>
  </row>

PS: Final HTML Panel added to test out token changes.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

niketn
Legend

Hi Please try the following, I have also changed a bit to get rid of Submit button and enable search on change instead(since tokens are being set on change events anyways). Also since there is a dependency between tier1app and role dropdowns, I am unsetting tokens for role dropdown and tier1servers on change of tier1app value. You can change accordingly for counter dropdown as well or remove these changes, if you need submit button.

  <fieldset submitButton="false">
    <input type="dropdown" token="tier1app" searchWhenChanged="true">
      <label>Tier 1 App</label>
      <choice value="Exchange">Exchange</choice>
      <choice value="OLB">OLB</choice>
      <change>
        <unset token="role"></unset>
        <unset token="form.role"></unset>
        <unset token="tier1servers"></unset>
      </change>
    </input>
    <input type="dropdown" token="role" searchWhenChanged="true">
      <label>Role</label>
      <choice value="App/Service">App/Service</choice>
      <choice value="DB">DB</choice>
      <choice value="Web/UI">Web/UI</choice>
      <change>
        <condition match="$label$=&quot;App/Service&quot; AND $tier1app$=&quot;OLB&quot;">
          <set token="tier1servers">("VMSVC01.INSIDE","VMSVC02.INSIDE","VMWEBSVC01.INSIDE","VMWEBSVC02.INSIDE")</set>
        </condition>
        <condition match="$label$=&quot;App/Service&quot; AND $tier1app$=&quot;Exchange&quot;">
          <set token="tier1servers">("EXCH01.INSIDE","EXCH02.INSIDE","EXCHAZ01.INSIDE","EXCHAZ02.INSIDE"")</set>
        </condition>
        <condition label="DB">
          <set token="tier1servers">("SQLOB01.INSIDE","SQLOB02.INSIDE","SQLF01.INSIDE","SQLF02.INSIDE")</set>
        </condition>
        <condition label="Web/UI">
          <set token="tier1servers">("CVMUI01.INSIDE","CVMUI02.INSIDE")</set>
        </condition>
      </change>
    </input>
    <input type="dropdown" token="counter" searchWhenChanged="true">
      <label>Counter</label>
      <choice value="CPU">CPU</choice>
      <choice value="Disk">Disk</choice>
      <choice value="Memory">Memory</choice>
      <change>
        <condition label="CPU">
          <set token="counterchoice">| where (CounterName="% Processor Time")</set>
        </condition>
        <condition label="Disk">
          <set token="counterchoice">| where (CounterName="% Disk Used")</set>
        </condition>
        <condition label="Memory">
          <set token="counterchoice">| where (CounterName="% Memory Used")</set>
        </condition>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <html>
        $tier1app$
        <br/>$role$</br>
        <br/>$tier1servers$</br>
        <br/>$counter$</br>
        <br/>$counterchoice$</br>
      </html>
    </panel>
  </row>

PS: Final HTML Panel added to test out token changes.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...