Dashboards & Visualizations
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
Ask a Question
Solved! Jump to solution

How to filter the data of lookup based on the drop-down values

aditsss
Motivator
‎11-15-2020 06:46 AM

Hi Everyone,

I have one drop -down in the dashboard .Below is code for the drop-down.

<input type="multiselect" token="Teams" searchWhenChanged="true">
<label>Teams</label>
<choice value="*">All</choice>
<choice value="Force">Force</choice>
<choice value="Blaz">BLAZ</choice>
<choice value="OneForce">Oneforce</choice>
<choice value="Auto">Auto</choice>
<fieldForLabel>Teams</fieldForLabel>
<prefix>(</prefix>
<valuePrefix>Teams ="</valuePrefix>
<valueSuffix>"</valueSuffix>
<delimiter> OR </delimiter>
<suffix>)</suffix>
<initialValue>*</initialValue>
<default>*</default>
</input>

I have one panel in same dashboard which is showing below fields. URL and Parent chain and many other fields.

       URL                                                              PARENT CHAIN

1)  https:/abcd/process-groups/      MAIN-->root-->BLAZ - E1-->Blaz Transformation - Data Ingestion

2)https:/abc/process-groups/           MAIN-->root-->BLAZ - E3

3)https:/abc/process-groups/           MAIN-->root-->Oneforce-->FXIP

My parent chain is coming from inputlookup that I have highlighted. Below is the code for the query:

<row>
<table>
<search>
<query>index=abc sourcetype=xyz source="/user.log" process-groups|rename count as "Request Counts" |rex field=Request_URL "(?&lt;id&gt;[A_Za-z0-9]{8}[\-][A_Za-z0-9]{4}[\-][A_Za-z0-9]{4}[\-][A_Za-z0-9]{4}[\-][A_Za-z0-9]{12})"|stats count by Date ADS_Id Request_Type id ClickHere Request_URL|sort - ADS_Id |join type=outer id [inputlookup chains.csv]</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
<sampleRatio>1</sampleRatio>
</search>
<fields>"Date", "ADS_Id","Request_Type", "Request_URL", "id", "parent_chain"</fields>
<option name="count">100</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
<option name="percentagesRow">false</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>
</row>

I want when I select say "Blaz" from the teams drop-down then the parent chain which consists of 3rd word as   "-->BLAZ"  like :

MAIN-->root-->BLAZ - E1-->Blaz Transformation - Data Ingestion

MAIN-->root-->BLAZ - E3

when I select say Oneforce from the teams drop-down then the parent chain which consists of 3rd word as   "-->Oneforce"  like :

 MAIN-->root-->Oneforce-->FXIP.

Can someone guide me on this.

Thanks in advance.

Labels (3)
Labels
0 Karma
Reply
1 Solution
Solved! Jump to solution
Solution

ITWhisperer
SplunkTrust
SplunkTrust
‎12-09-2020 10:11 AM

Try this

<choice value="true()">All</choice>
<choice value="like(parent_chain, &quot;%BLAZE%&quot;)">BLAZE</choice>
<choice value="like(parent_chain, &quot;%Oneforce%&quot;)">Oneforce</choice>
<choice value="like(parent_chain, &quot;%MerchantForce%&quot;)">MerchantForce</choice>
<choice value="like(parent_chain, &quot;%MDT%&quot;)">MDT</choice>
<choice value="like(parent_chain, &quot;%ConsumerForce%&quot;)">ConsumerForce</choice>
<choice value="like(parent_chain, &quot;%Mkt-Auto%&quot;)">Mkt-Auto</choice>
<choice value="like(parent_chain, &quot;%MarketingForce%&quot;)">MarketingForce</choice>
<choice value="like(parent_chain, &quot;%PremiumProductPlatform%&quot;)">PremiumProductPlatform</choice>

View solution in original post

Reply
Solved! Jump to solution

somesoni2
Revered Legend
‎12-05-2020 01:07 PM

Try something like this (changed how token was formatted in your multiselect, replaced join with lookup command and used token in correct place).

 

<?xml version="1.0" encoding="UTF-8"?>
<form>
    <fieldset>
        <input type="multiselect" token="Teams" searchWhenChanged="true">
            <label>Teams</label>
            <choice value="*">All</choice>
            <choice value="Force">Force</choice>
            <choice value="Blaz">BLAZ</choice>
            <choice value="OneForce">Oneforce</choice>
            <choice value="Auto">Auto</choice>
            <fieldForLabel>Teams</fieldForLabel>
            <prefix>(</prefix>
            <valuePrefix> parent_chain="*</valuePrefix>
            <valueSuffix>*"</valueSuffix>
            <delimiter> OR </delimiter>
            <suffix>)</suffix>
            <initialValue>*</initialValue>
            <default>*</default>
        </input>
    </fieldset>
    <row>
        <table>
            <search>
                <query>index=abc sourcetype=xyz source="/user.log" process-groups|rename count as "Request Counts" |rex field=Request_URL "(?&lt;id&gt;[A_Za-z0-9]{8}[\-][A_Za-z0-9]{4}[\-][A_Za-z0-9]{4}[\-][A_Za-z0-9]{4}[\-][A_Za-z0-9]{12})"|stats count by Date ADS_Id Request_Type id ClickHere Request_URL|sort - ADS_Id |lookup chains.csv id OUTPUT parent_chain | where $Teams$</query>
                <earliest>$field1.earliest$</earliest>
                <latest>$field1.latest$</latest>
                <sampleRatio>1</sampleRatio>
            </search>
            <fields>"Date", "ADS_Id","Request_Type", "Request_URL", "id", "parent_chain"</fields>
            <option name="count">100</option>
            <option name="dataOverlayMode">none</option>
            <option name="drilldown">cell</option>
            <option name="percentagesRow">false</option>
            <option name="refresh.display">progressbar</option>
            <option name="rowNumbers">false</option>
            <option name="totalsRow">false</option>
            <option name="wrap">true</option>
        </table>
    </row>
</form>

 

0 Karma
Reply
Solved! Jump to solution

aditsss
Motivator
‎12-08-2020 12:30 AM

@somesoni2 

I have tried this but nothing is coming.

Its showing Result not found.

Can you let me know where I have gone wrong:

Multiselect code:

<input type="multiselect" token="Teams" searchWhenChanged="true">
<label>Teams</label>
<choice value="*">All</choice>
<choice value="BLAZE">BLAZE</choice>
<choice value="Oneforce">Oneforce</choice>
<fieldForLabel>Teams</fieldForLabel>
<prefix>(</prefix>
<valuePrefix> parent_chain="*</valuePrefix>
<valueSuffix>*"</valueSuffix>
<delimiter> OR </delimiter>
<suffix>)</suffix>
<initialValue>*</initialValue>
<default>*</default>
</input>

My panel code from where parent chain is coming:

<row>
<table>
<search>
<query>index=abc sourcetype=xyz source="user.log" process-groups | convert timeformat="%Y-%m-%d" ctime(_time) AS Date|rename count as "Request Counts" |rex field=Request_URL "(?&lt;id&gt;[A_Za-z0-9]{8}[\-][A_Za-z0-9]{4}[\-][A_Za-z0-9]{4}[\-][A_Za-z0-9]{4}[\-][A_Za-z0-9]{12})"|stats count by Date ADS_Id Request_Type id ClickHere Request_URL|sort - ADS_Id |lookup nifi_api_parent_chains.csv id OUTPUT parent_chain | where $Teams$</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
<sampleRatio>1</sampleRatio>
</search>
<fields>"Date", "ADS_Id","Request_Type", "Request_URL", "id", "parent_chain"</fields>
<option name="count">100</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
<option name="percentagesRow">false</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<drilldown>
<condition field="Request_URL">
<link target="_blank">$row.ClickHere|n$</link>
</condition>
</drilldown>
</table>
</row>

Can you guide me on that.

0 Karma
Reply
Solved! Jump to solution

ITWhisperer
SplunkTrust
SplunkTrust
‎12-09-2020 04:09 AM

What do you get if you remove the "where $Teams$"? Do you get the results you expect just unfiltered?

0 Karma
Reply
Solved! Jump to solution

aditsss
Motivator
‎12-09-2020 04:44 AM

@ITWhisperer 

Yes I am able to get the result unfiltered. All the parent chains are coming. when I remove where $Teams$ from the query.

0 Karma
Reply
Solved! Jump to solution

ITWhisperer
SplunkTrust
SplunkTrust
‎12-09-2020 04:50 AM

What about if you use 

| where (parent_chain="*BLAZE*")
0 Karma
Reply
Solved! Jump to solution

aditsss
Motivator
‎12-09-2020 05:23 AM

@ITWhisperer 

Can you guide me is that correct I have tried something like this:

multiselect code:

<input type="multiselect" token="Teams" searchWhenChanged="true">
<label>Teams</label>
<choice value=" ">All</choice>
<choice value="BLAZE">BLAZE</choice>
<choice value="Oneforce">Oneforce</choice>
<choice value="MerchantForce">MerchantForce</choice>
<choice value="MDT">MDT</choice>
<choice value="ConsumerForce">ConsumerForce</choice>
<choice value="Mkt-Auto">Mkt-Auto</choice>
<choice value="MarketingForce">MarketingForce</choice>
<choice value="PremiumProductPlatform">PremiumProductPlatform</choice>
<fieldForLabel>Teams</fieldForLabel>
<valuePrefix>%</valuePrefix>
<valueSuffix>%</valueSuffix>
<delimiter> OR </delimiter>
<initialValue>All</initialValue>
<default>All</default>
</input>

panel code:

<row>
<table>
<search>
<query>index=abc sourcetype=xyz source="user.log" process-groups | convert timeformat="%Y-%m-%d" ctime(_time) AS Date|rename count as "Request Counts" |rex field=Request_URL "(?&lt;id&gt;[A_Za-z0-9]{8}[\-][A_Za-z0-9]{4}[\-][A_Za-z0-9]{4}[\-][A_Za-z0-9]{4}[\-][A_Za-z0-9]{12})"|fillnull value="" id| eval ClickHere= "https://com/abc/?processGroupId=".id|stats count by Date ADS_Id Request_Type id ClickHere Request_URL|sort - ADS_Id |join type=outer id [inputlookup nifi_api_parent_chains.csv]|where like(parent_chain, "$Teams$")</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
<sampleRatio>1</sampleRatio>
</search>
<fields>"Date", "ADS_Id","Request_Type", "Request_URL", "id", "parent_chain"</fields>
<option name="count">100</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
<option name="percentagesRow">false</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<drilldown>
<condition field="Request_URL">
<link target="_blank">$row.ClickHere|n$</link>
</condition>
</drilldown>
</table>
</row>

when I am selecting "BLAZE" from multiselect I am able to get the "BLAZE" result from parent chain.

when I am selecting "OneForce" from multiselect I am able to get the "OneForce" result from the parent chain.

The issue I am facing is when I am selecting both "BLAZE" and "OneForce" from multiselect its showing "NO result Found". Its only working individually.

Also when I am selecting "ALL" its not showing the rows which does not include the parent_chain.

Can you please guide me where I have gone wrong.

Thanks in advance.

0 Karma
Reply
Solved! Jump to solution

ITWhisperer
SplunkTrust
SplunkTrust
‎12-09-2020 05:45 AM

Try this in your dropdown

<choice value="">All</choice>

and

<prefix>(</prefix>
<valuePrefix>like(parent_chain, "%</valuePrefix>
<valueSuffix>%")</valueSuffix>
<delimiter> OR </delimiter>
<suffix>)</suffix>

and in your query

where $Teams$

 

Reply
Solved! Jump to solution

aditsss
Motivator
‎12-09-2020 08:11 AM

@ITWhisperer 

Your are best as always ....

Just one query when I am selecting "All" its not showing the rows where parent chain are not present.

I want when I select "All" it should also show the rows where parent chain is not present as panel contains other fields also.

Multiselect code:

<input type="multiselect" token="Teams" searchWhenChanged="true">
<label>Teams</label>
<choice value="">All</choice>
<choice value="BLAZE">BLAZE</choice>
<choice value="Oneforce">Oneforce</choice>
<choice value="MerchantForce">MerchantForce</choice>
<choice value="MDT">MDT</choice>
<choice value="ConsumerForce">ConsumerForce</choice>
<choice value="Mkt-Auto">Mkt-Auto</choice>
<choice value="MarketingForce">MarketingForce</choice>
<choice value="PremiumProductPlatform">PremiumProductPlatform</choice>
<fieldForLabel>Teams</fieldForLabel>
<prefix>(</prefix>
<valuePrefix>like(parent_chain, "%</valuePrefix>
<valueSuffix>%")</valueSuffix>
<delimiter> OR </delimiter>
<suffix>)</suffix>
<initialValue>All</initialValue>
<default>All</default>
</input>
</fieldset>

panel code:

<row>
<table>
<search>
<query>index=abc sourcetype=xyz source="user.log" process-groups | convert timeformat="%Y-%m-%d" ctime(_time) AS Date|rename count as "Request Counts" |rex field=Request_URL "(?&lt;id&gt;[A_Za-z0-9]{8}[\-][A_Za-z0-9]{4}[\-][A_Za-z0-9]{4}[\-][A_Za-z0-9]{4}[\-][A_Za-z0-9]{12})"|fillnull value="" id| eval ClickHere= "https://abc/xyz/?processGroupId=".id|stats count by Date ADS_Id Request_Type id ClickHere Request_URL|sort - ADS_Id |join type=outer id [inputlookup nifi_api_parent_chains.csv]|where $Teams$</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
<sampleRatio>1</sampleRatio>
</search>
<fields>"Date", "ADS_Id","Request_Type", "Request_URL", "id", "parent_chain"</fields>
<option name="count">100</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
<option name="percentagesRow">false</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<drilldown>
<condition field="Request_URL">
<link target="_blank">$row.ClickHere|n$</link>
</condition>
</drilldown>
</table>
</row>

Can you guide me here.

Thanks in advance.

0 Karma
Reply
Solved! Jump to solution

aditsss
Motivator
‎12-09-2020 09:49 AM

@ITWhisperer 

Its taking two values also now in multiselect drop down.

The only issue I am facing now is there are certain rows in the panel which does not contain parent chain but it contains rest fields that rows are not coming.

Only the rows which contain parent chain is coming.

Can you please guide me on that.

Multiselect code:

<input type="multiselect" token="Teams" searchWhenChanged="true">
<label>Teams</label>
<choice value="">All</choice>
<choice value="BLAZE">BLAZE</choice>
<choice value="Oneforce">Oneforce</choice>
<choice value="MerchantForce">MerchantForce</choice>
<choice value="MDT">MDT</choice>
<choice value="ConsumerForce">ConsumerForce</choice>
<choice value="Mkt-Auto">Mkt-Auto</choice>
<choice value="MarketingForce">MarketingForce</choice>
<choice value="PremiumProductPlatform">PremiumProductPlatform</choice>
<fieldForLabel>Teams</fieldForLabel>
<prefix>(</prefix>
<valuePrefix>like(parent_chain, "%</valuePrefix>
<valueSuffix>%")</valueSuffix>
<delimiter> OR </delimiter>
<suffix>)</suffix>
<initialValue>All</initialValue>
<default>All</default>
</input>
</fieldset>

panel code:

<row>
<table>
<search>
<query>index=abc sourcetype=xyz source="user.log" process-groups | convert timeformat="%Y-%m-%d" ctime(_time) AS Date|rename count as "Request Counts" |rex field=Request_URL "(?&lt;id&gt;[A_Za-z0-9]{8}[\-][A_Za-z0-9]{4}[\-][A_Za-z0-9]{4}[\-][A_Za-z0-9]{4}[\-][A_Za-z0-9]{12})"|fillnull value="" id| eval ClickHere= "https://abc/xyz/?processGroupId=".id|stats count by Date ADS_Id Request_Type id ClickHere Request_URL|sort - ADS_Id |join type=outer id [inputlookup nifi_api_parent_chains.csv]|where $Teams$</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
<sampleRatio>1</sampleRatio>
</search>
<fields>"Date", "ADS_Id","Request_Type", "Request_URL", "id", "parent_chain"</fields>
<option name="count">100</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
<option name="percentagesRow">false</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<drilldown>
<condition field="Request_URL">
<link target="_blank">$row.ClickHere|n$</link>
</condition>
</drilldown>
</table>
</row>

Thanks in advance.

0 Karma
Reply
Solved! Jump to solution

ITWhisperer
SplunkTrust
SplunkTrust
‎12-09-2020 09:46 AM 
<choice value="true()">All</choice>
<choice value="like(parent_chain, \"%BLAZE%\")">BLAZE</choice>
<choice value="like(parent_chain, \"%Oneforce%\")">Oneforce</choice>
<choice value="like(parent_chain, \"%MerchantForce%\")">MerchantForce</choice>
<choice value="like(parent_chain, \"%MDT%\")">MDT</choice>
<choice value="like(parent_chain, \"%ConsumerForce%\")">ConsumerForce</choice>
<choice value="like(parent_chain, \"%Mkt-Auto%\")">Mkt-Auto</choice>
<choice value="like(parent_chain, \"%MarketingForce%\")">MarketingForce</choice>
<choice value="like(parent_chain, \"%PremiumProductPlatform%\")">PremiumProductPlatform</choice>

and

<prefix>(</prefix>
<delimiter> OR </delimiter>
<suffix>)</suffix>
0 Karma
Reply
Solved! Jump to solution

aditsss
Motivator
‎12-09-2020 10:05 AM

@ITWhisperer 

I have put the code the multiselect as below:

<input type="multiselect" token="Teams" searchWhenChanged="true">
<label>Teams</label>
<choice value="true()">All</choice>
<choice value="like(parent_chain, \"%BLAZE%\")">BLAZE</choice>
<choice value="like(parent_chain, \"%Oneforce%\")">Oneforce</choice>
<choice value="like(parent_chain, \"%MerchantForce%\")">MerchantForce</choice>
<choice value="like(parent_chain, \"%MDT%\")">MDT</choice>
<choice value="like(parent_chain, \"%ConsumerForce%\")">ConsumerForce</choice>
<choice value="like(parent_chain, \"%Mkt-Auto%\")">Mkt-Auto</choice>
<choice value="like(parent_chain, \"%MarketingForce%\")">MarketingForce</choice>
<choice value="like(parent_chain, \"%PremiumProductPlatform%\")">PremiumProductPlatform</choice>
<fieldForLabel>Teams</fieldForLabel>
<prefix>(</prefix>
<delimiter> OR </delimiter>
<suffix>)</suffix>
<initialValue>All</initialValue>
<default>All</default>
</input>

I am getting "Invalid Attribute Name" error . I have attached screenshot as well.

Can you please guide me on this.

Preview file
43 KB
0 Karma
Reply
Solved! Jump to solution
Solution

ITWhisperer
SplunkTrust
SplunkTrust
‎12-09-2020 10:11 AM

Try this

<choice value="true()">All</choice>
<choice value="like(parent_chain, &quot;%BLAZE%&quot;)">BLAZE</choice>
<choice value="like(parent_chain, &quot;%Oneforce%&quot;)">Oneforce</choice>
<choice value="like(parent_chain, &quot;%MerchantForce%&quot;)">MerchantForce</choice>
<choice value="like(parent_chain, &quot;%MDT%&quot;)">MDT</choice>
<choice value="like(parent_chain, &quot;%ConsumerForce%&quot;)">ConsumerForce</choice>
<choice value="like(parent_chain, &quot;%Mkt-Auto%&quot;)">Mkt-Auto</choice>
<choice value="like(parent_chain, &quot;%MarketingForce%&quot;)">MarketingForce</choice>
<choice value="like(parent_chain, &quot;%PremiumProductPlatform%&quot;)">PremiumProductPlatform</choice>
Reply
Solved! Jump to solution

aditsss
Motivator
‎12-10-2020 03:56 AM

@ITWhisperer 

Thank you so much. It works.

0 Karma
Reply
Solved! Jump to solution

aditsss
Motivator
‎12-08-2020 12:05 PM

@somesoni2 

I have tried this but nothing is coming.

Its showing Result not found.

Can you let me know where I have gone wrong:

Multiselect code:

<input type="multiselect" token="Teams" searchWhenChanged="true">
<label>Teams</label>
<choice value="*">All</choice>
<choice value="BLAZE">BLAZE</choice>
<choice value="Oneforce">Oneforce</choice>
<fieldForLabel>Teams</fieldForLabel>
<prefix>(</prefix>
<valuePrefix> parent_chain="*</valuePrefix>
<valueSuffix>*"</valueSuffix>
<delimiter> OR </delimiter>
<suffix>)</suffix>
<initialValue>*</initialValue>
<default>*</default>
</input>

My panel code from where parent chain is coming.

<row>
<table>
<search>
<query>index=abc sourcetype=xyz source="user.log" process-groups | convert timeformat="%Y-%m-%d" ctime(_time) AS Date|rename count as "Request Counts" |rex field=Request_URL "(?&lt;id&gt;[A_Za-z0-9]{8}[\-][A_Za-z0-9]{4}[\-][A_Za-z0-9]{4}[\-][A_Za-z0-9]{4}[\-][A_Za-z0-9]{12})"|stats count by Date ADS_Id Request_Type id ClickHere Request_URL|sort - ADS_Id |lookup nifi_api_parent_chains.csv id OUTPUT parent_chain | where $Teams$</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
<sampleRatio>1</sampleRatio>
</search>
<fields>"Date", "ADS_Id","Request_Type", "Request_URL", "id", "parent_chain"</fields>
<option name="count">100</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
<option name="percentagesRow">false</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<drilldown>
<condition field="Request_URL">
<link target="_blank">$row.ClickHere|n$</link>
</condition>
</drilldown>
</table>
</row>

Can you please guide me.

0 Karma
Reply
Solved! Jump to solution

aditsss
Motivator
‎11-15-2020 09:32 AM

Can anyone please guide me on this.

0 Karma
Reply
Solved! Jump to solution

aditsss
Motivator
‎11-15-2020 10:43 PM

Can someone please guide me on this.

0 Karma
Reply
Solved! Jump to solution

aditsss
Motivator
‎11-16-2020 01:07 AM

Can someone please guide me on this please.

I have made some changes like this. 

Drop-down code:

<input type="multiselect" token="teams" searchWhenChanged="true">
<label>Teams</label>
<choice value="All">All Teams</choice>
<choice value="BLAZE">BLAZE</choice>
<choice value="Oneforce">Oneforce</choice>
<fieldForLabel>Teams</fieldForLabel>
<prefix>(</prefix>
<valuePrefix>Teams ="</valuePrefix>
<valueSuffix>"</valueSuffix>
<delimiter> OR </delimiter>
<suffix>)</suffix>
<initialValue>All</initialValue>
<default>All</default>
<change>
<eval token="form.teams">case(mvcount('form.teams')=0,"All",mvcount('form.teams')&gt;1 AND mvfind('form.teams',"All")&gt;0,"All",mvcount('form.teams')&gt;1 AND mvfind('form.teams',"All")=0,mvfilter('form.teams'!="All"),1==1,'form.teams')</eval>
<eval token="BLAZE">if(isnull(mvfind('form.teams',"BLAZE")),mvfind('form.teams',"All"),1)</eval>
<eval token="Oneforce">if(isnull(mvfind('form.teams',"Oneforce")),mvfind('form.teams',"All"),1)</eval>
<eval token="org_choice">if(mvfind('form.teams',"All")=0,$teams$)</eval>
</change>
</input>

Query code I have passed token in the queries like this but its not working.

<row>
<table>
<search>
<query>index=abc sourcetype=xyz source="/user.log" process-groups $BLAZE$ OR $Oneforce$|rename count as "Request Counts" |rex field=Request_URL "(?&lt;id&gt;[A_Za-z0-9]{8}[\-][A_Za-z0-9]{4}[\-][A_Za-z0-9]{4}[\-][A_Za-z0-9]{4}[\-][A_Za-z0-9]{12})"|stats count by Date ADS_Id Request_Type id ClickHere Request_URL|sort - ADS_Id |join type=outer id [inputlookup chains.csv]</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
<sampleRatio>1</sampleRatio>
</search>
<fields>"Date", "ADS_Id","Request_Type", "Request_URL", "id", "parent_chain"</fields>
<option name="count">100</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
<option name="percentagesRow">false</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>
</row>

Can someone please guide me on this.

0 Karma
Reply
Solved! Jump to solution

aditsss
Motivator
‎11-16-2020 07:48 AM

Someone please help me out in this .please

0 Karma
Reply
Solved! Jump to solution

ITWhisperer
SplunkTrust
SplunkTrust
‎11-16-2020 11:18 AM

Shouldn't "[A_Za-z0-9]" be "[A-Za-z0-9]"?

Is parent chain returned by the lookup or is it in your initial search events?

0 Karma
Reply
Solved! Jump to solution

aditsss
Motivator
‎11-16-2020 11:32 AM

@ITWhisperer 

The parent chain is returned by the lookup.

Requirement:

I have one dashboard which consists of drop down and panels.

I have one drop down as "Teams" whose code is as below:

<input type="multiselect" token="teams" searchWhenChanged="true">
<label>Teams</label>
<choice value="All">All Teams</choice>
<choice value="BLAZE">BLAZE</choice>
<choice value="Oneforce">Oneforce</choice>
<fieldForLabel>Teams</fieldForLabel>
<prefix>(</prefix>
<valuePrefix>Teams ="</valuePrefix>
<valueSuffix>"</valueSuffix>
<delimiter> OR </delimiter>
<suffix>)</suffix>
<initialValue>All</initialValue>
<default>All</default>
<change>
<eval token="form.teams">case(mvcount('form.teams')=0,"All",mvcount('form.teams')&gt;1 AND mvfind('form.teams',"All")&gt;0,"All",mvcount('form.teams')&gt;1 AND mvfind('form.teams',"All")=0,mvfilter('form.teams'!="All"),1==1,'form.teams')</eval>
<eval token="BLAZE">if(isnull(mvfind('form.teams',"BLAZE")),mvfind('form.teams',"All"),1)</eval>
<eval token="Oneforce">if(isnull(mvfind('form.teams',"Oneforce")),mvfind('form.teams',"All"),1)</eval>
<eval token="org_choice">if(mvfind('form.teams',"All")=0,$teams$)</eval>
</change>
</input>

I have one panel which is showing multiple fields including parent chain and parent chain is coming from inputlookup.

parent_chain

MAIN-->root-->BLAZE - E1-->Blaz Transformation - Data

MAIN-->root-->BLAZE - E3

MAIN-->root-->Oneforce-->FXIP

Below is the code of the panel. The parent chain is coming from inputlookup chains.csv .

what I want is when I select "BLAZE" from the teams drop-down all the parent chain which consists of 3rd word as "BLAZE" should be shown .Basically the parent chain which include the word as "BLAZE" should come. Like below:

MAIN-->root-->BLAZE - E1-->Blaz Transformation - Data

MAIN-->root-->BLAZE - E3

when I select the word "Oneforce" from teams drop-down the parent chain which consists of word "Oneforce" should come like this:

MAIN-->root-->Oneforce-->FXIP

MAIN-->root-->Oneforce-->Support_Tools

I have passed the tokens as $BLAZE$ OR $Oneforce$ in query but still result is not filtering.

Below is the code for it.

<row>
<table>
<search>
<query>index=abc sourcetype=xyz source="/user.log" process-groups $BLAZE$ OR $Oneforce$|rename count as "Request Counts" |rex field=Request_URL "(?&lt;id&gt;[A-Za-z0-9]{8}[\-][A-Za-z0-9]{4}[\-][A-Za-z0-9]{4}[\-][A-Za-z0-9]{4}[\-][A-Za-z0-9]{12})"|stats count by Date ADS_Id Request_Type id ClickHere Request_URL|sort - ADS_Id |join type=outer id [inputlookup chains.csv]</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
<sampleRatio>1</sampleRatio>
</search>
<fields>"Date", "ADS_Id","Request_Type", "Request_URL", "id", "parent_chain"</fields>
<option name="count">100</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
<option name="percentagesRow">false</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>
</row>

 

@ITWhisperer  please guide me. Your solutions always works for me.

Thanks in advance.

0 Karma
Reply
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...