Dashboards & Visualizations

How to pass multiple values for a field through token in a dashboard?

Soundaryakunder
Loves-to-Learn Lots

Dashboard is taking a long time to load and it has 17 apps in one panel. I have also tried creating a token such as <set token="app_names">app1,app2</set> instead of using wildcard.  but query is not returning any result.

Code snippet

 

 <init>
    <set token="app_names">app1,app2,app3................</set>
 </init>
 ......
  <row>
    <panel>
      <title>Dashboard</title>
      <table>
         <search>
          <query>index=idx ns=xyz* app_name=$app_names$ pod_container=xyz* ((" ERROR " OR " WARN ")
		  |stats count by app_name
          | append
    [| stats count
    | eval app_name="app1,app2,app3........"
    | table app_name
    | makemv app_name delim=","
    | mvexpand app_name]
	.......

 

 

Please advise!

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Would something like this help?

index=idx ns=xyz* app_name IN ($app_names$) ...
0 Karma

Soundaryakunder
Loves-to-Learn Lots

Your solution really helped. Thank you very much

0 Karma

Soundaryakunder
Loves-to-Learn Lots

 I have created a dashboard with 3 panels and it has 17 apps.

 

Please help me on this.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

It depends on what you are trying to display in your dashboard - if you have 17 searches to do, this will take some time - there are various optimisations available but it depends on your use case - things to consider are summary indexes, saved reports, splitting across multiple dashboards, hiding panels until data is available, etc.

0 Karma

Soundaryakunder
Loves-to-Learn Lots

Okay. Thanks

0 Karma

Soundaryakunder
Loves-to-Learn Lots

I need one more help..

I have already specified the multiple values(app1,app2,app3.....)in the token. So I have tried to remove the eval(eval app_name="app1,app2,app3........") command from the Query. but it is returning wrong results. Is this eval command is required?

Please suggest me on this.

 <init>
    <set token="app_names">app1,app2,app3................</set>
 </init>
 ......
  <row>
    <panel>
      <title>Dashboard</title>
      <table>
         <search>
          <query>index=idx ns=xyz* app_name IN ($app_names$) pod_container=xyz* ((" ERROR " OR " WARN ")
		  |stats count by app_name
          | append
    [| stats count
    | eval app_name="app1,app2,app3........"
    | table app_name
    | makemv app_name delim=","
    | mvexpand app_name]
	.......

 Thanks.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...