Dashboards & Visualizations

How to edit my dashboard to get the condition statement to work properly?

jeffbat
Path Finder

I am having an issue with getting a dashboard panel to work properly based off multiple input fields being chosen.

Basically, I have a dashboard that has 3 input fields; Tier 1 App, Role, Counter. right now I just have 2 apps listed (Exchange & OLB), for Role it would be App/Service, DB, Web/UI, and for Counter it is CPU, Memory, Disk.

What I need to happen is a token is being set based on Tier 1 App and Role combined.

I have tried this but it is not working.

  <fieldset submitButton="true">
    <input type="dropdown" token="tier1app" searchWhenChanged="false">
      <label>Tier 1 App</label>
      <choice value="Exchange">Exchange</choice>
      <choice value="OLB">OLB</choice>
    </input>
    <input type="dropdown" token="role" searchWhenChanged="false">
      <label>Role</label>
      <choice value="App/Service">App/Service</choice>
      <choice value="DB">DB</choice>
      <choice value="Web/UI">Web/UI</choice>
      <change>
        <condition label="App/Service">
          <condition $tier1app$="OLB">
            <set token="tier1servers">("VMSVC01.INSIDE","VMSVC02.INSIDE","VMWEBSVC01.INSIDE","VMWEBSVC02.INSIDE")</set>
          </condition>
          <condition $tier1app$="Exchange">
            <set token="tier1servers">("EXCH01.INSIDE","EXCH02.INSIDE","EXCHAZ01.INSIDE","EXCHAZ02.INSIDE"")</set>
          </condition>
        </condition>
        <condition label="DB">
          <set token="tier1servers">("SQLOB01.INSIDE","SQLOB02.INSIDE","SQLF01.INSIDE","SQLF02.INSIDE")</set>
        </condition>
        <condition label="Web/UI">
          <set token="tier1servers">("CVMUI01.INSIDE","CVMUI02.INSIDE")</set>
        </condition>
      </change>
    </input>
    <input type="dropdown" token="counter" searchWhenChanged="false">
      <label>Counter</label>
      <choice value="CPU">CPU</choice>
      <choice value="Disk">Disk</choice>
      <choice value="Memory">Memory</choice>
      <change>
        <condition label="CPU">
          <set token="counterchoice">| where (CounterName="% Processor Time")</set>
        </condition>
        <condition label="Disk">
          <set token="counterchoice">| where (CounterName="% Disk Used")</set>
        </condition>
        <condition label="Memory">
          <set token="counterchoice">| where (CounterName="% Memory Used")</set>
        </condition>
      </change>
    </input>
  </fieldset>

When trying to do the match on the token (tier1app) from the first input and the role in the second one, when running it just sits there and says Search is waiting for input...

Anyone have any ideas how to get this setup to work?

0 Karma
1 Solution

niketn
Legend

Hi Please try the following, I have also changed a bit to get rid of Submit button and enable search on change instead(since tokens are being set on change events anyways). Also since there is a dependency between tier1app and role dropdowns, I am unsetting tokens for role dropdown and tier1servers on change of tier1app value. You can change accordingly for counter dropdown as well or remove these changes, if you need submit button.

  <fieldset submitButton="false">
    <input type="dropdown" token="tier1app" searchWhenChanged="true">
      <label>Tier 1 App</label>
      <choice value="Exchange">Exchange</choice>
      <choice value="OLB">OLB</choice>
      <change>
        <unset token="role"></unset>
        <unset token="form.role"></unset>
        <unset token="tier1servers"></unset>
      </change>
    </input>
    <input type="dropdown" token="role" searchWhenChanged="true">
      <label>Role</label>
      <choice value="App/Service">App/Service</choice>
      <choice value="DB">DB</choice>
      <choice value="Web/UI">Web/UI</choice>
      <change>
        <condition match="$label$=&quot;App/Service&quot; AND $tier1app$=&quot;OLB&quot;">
          <set token="tier1servers">("VMSVC01.INSIDE","VMSVC02.INSIDE","VMWEBSVC01.INSIDE","VMWEBSVC02.INSIDE")</set>
        </condition>
        <condition match="$label$=&quot;App/Service&quot; AND $tier1app$=&quot;Exchange&quot;">
          <set token="tier1servers">("EXCH01.INSIDE","EXCH02.INSIDE","EXCHAZ01.INSIDE","EXCHAZ02.INSIDE"")</set>
        </condition>
        <condition label="DB">
          <set token="tier1servers">("SQLOB01.INSIDE","SQLOB02.INSIDE","SQLF01.INSIDE","SQLF02.INSIDE")</set>
        </condition>
        <condition label="Web/UI">
          <set token="tier1servers">("CVMUI01.INSIDE","CVMUI02.INSIDE")</set>
        </condition>
      </change>
    </input>
    <input type="dropdown" token="counter" searchWhenChanged="true">
      <label>Counter</label>
      <choice value="CPU">CPU</choice>
      <choice value="Disk">Disk</choice>
      <choice value="Memory">Memory</choice>
      <change>
        <condition label="CPU">
          <set token="counterchoice">| where (CounterName="% Processor Time")</set>
        </condition>
        <condition label="Disk">
          <set token="counterchoice">| where (CounterName="% Disk Used")</set>
        </condition>
        <condition label="Memory">
          <set token="counterchoice">| where (CounterName="% Memory Used")</set>
        </condition>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <html>
        $tier1app$
        <br/>$role$</br>
        <br/>$tier1servers$</br>
        <br/>$counter$</br>
        <br/>$counterchoice$</br>
      </html>
    </panel>
  </row>

PS: Final HTML Panel added to test out token changes.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

niketn
Legend

Hi Please try the following, I have also changed a bit to get rid of Submit button and enable search on change instead(since tokens are being set on change events anyways). Also since there is a dependency between tier1app and role dropdowns, I am unsetting tokens for role dropdown and tier1servers on change of tier1app value. You can change accordingly for counter dropdown as well or remove these changes, if you need submit button.

  <fieldset submitButton="false">
    <input type="dropdown" token="tier1app" searchWhenChanged="true">
      <label>Tier 1 App</label>
      <choice value="Exchange">Exchange</choice>
      <choice value="OLB">OLB</choice>
      <change>
        <unset token="role"></unset>
        <unset token="form.role"></unset>
        <unset token="tier1servers"></unset>
      </change>
    </input>
    <input type="dropdown" token="role" searchWhenChanged="true">
      <label>Role</label>
      <choice value="App/Service">App/Service</choice>
      <choice value="DB">DB</choice>
      <choice value="Web/UI">Web/UI</choice>
      <change>
        <condition match="$label$=&quot;App/Service&quot; AND $tier1app$=&quot;OLB&quot;">
          <set token="tier1servers">("VMSVC01.INSIDE","VMSVC02.INSIDE","VMWEBSVC01.INSIDE","VMWEBSVC02.INSIDE")</set>
        </condition>
        <condition match="$label$=&quot;App/Service&quot; AND $tier1app$=&quot;Exchange&quot;">
          <set token="tier1servers">("EXCH01.INSIDE","EXCH02.INSIDE","EXCHAZ01.INSIDE","EXCHAZ02.INSIDE"")</set>
        </condition>
        <condition label="DB">
          <set token="tier1servers">("SQLOB01.INSIDE","SQLOB02.INSIDE","SQLF01.INSIDE","SQLF02.INSIDE")</set>
        </condition>
        <condition label="Web/UI">
          <set token="tier1servers">("CVMUI01.INSIDE","CVMUI02.INSIDE")</set>
        </condition>
      </change>
    </input>
    <input type="dropdown" token="counter" searchWhenChanged="true">
      <label>Counter</label>
      <choice value="CPU">CPU</choice>
      <choice value="Disk">Disk</choice>
      <choice value="Memory">Memory</choice>
      <change>
        <condition label="CPU">
          <set token="counterchoice">| where (CounterName="% Processor Time")</set>
        </condition>
        <condition label="Disk">
          <set token="counterchoice">| where (CounterName="% Disk Used")</set>
        </condition>
        <condition label="Memory">
          <set token="counterchoice">| where (CounterName="% Memory Used")</set>
        </condition>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <html>
        $tier1app$
        <br/>$role$</br>
        <br/>$tier1servers$</br>
        <br/>$counter$</br>
        <br/>$counterchoice$</br>
      </html>
    </panel>
  </row>

PS: Final HTML Panel added to test out token changes.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  &#x1f680; Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...