Dashboards & Visualizations

How to pass multiple values for a field through token in a dashboard?

Soundaryakunder
Loves-to-Learn Lots

Dashboard is taking a long time to load and it has 17 apps in one panel. I have also tried creating a token such as <set token="app_names">app1,app2</set> instead of using wildcard.  but query is not returning any result.

Code snippet

 

 <init>
    <set token="app_names">app1,app2,app3................</set>
 </init>
 ......
  <row>
    <panel>
      <title>Dashboard</title>
      <table>
         <search>
          <query>index=idx ns=xyz* app_name=$app_names$ pod_container=xyz* ((" ERROR " OR " WARN ")
		  |stats count by app_name
          | append
    [| stats count
    | eval app_name="app1,app2,app3........"
    | table app_name
    | makemv app_name delim=","
    | mvexpand app_name]
	.......

 

 

Please advise!

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Would something like this help?

index=idx ns=xyz* app_name IN ($app_names$) ...
0 Karma

Soundaryakunder
Loves-to-Learn Lots

Your solution really helped. Thank you very much

0 Karma

Soundaryakunder
Loves-to-Learn Lots

 I have created a dashboard with 3 panels and it has 17 apps.

 

Please help me on this.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

It depends on what you are trying to display in your dashboard - if you have 17 searches to do, this will take some time - there are various optimisations available but it depends on your use case - things to consider are summary indexes, saved reports, splitting across multiple dashboards, hiding panels until data is available, etc.

0 Karma

Soundaryakunder
Loves-to-Learn Lots

Okay. Thanks

0 Karma

Soundaryakunder
Loves-to-Learn Lots

I need one more help..

I have already specified the multiple values(app1,app2,app3.....)in the token. So I have tried to remove the eval(eval app_name="app1,app2,app3........") command from the Query. but it is returning wrong results. Is this eval command is required?

Please suggest me on this.

 <init>
    <set token="app_names">app1,app2,app3................</set>
 </init>
 ......
  <row>
    <panel>
      <title>Dashboard</title>
      <table>
         <search>
          <query>index=idx ns=xyz* app_name IN ($app_names$) pod_container=xyz* ((" ERROR " OR " WARN ")
		  |stats count by app_name
          | append
    [| stats count
    | eval app_name="app1,app2,app3........"
    | table app_name
    | makemv app_name delim=","
    | mvexpand app_name]
	.......

 Thanks.

0 Karma
Get Updates on the Splunk Community!

New Dates, New City: Save the Date for .conf25!

Wake up, babe! New .conf25 dates AND location just dropped!! That's right, this year, .conf25 is taking place ...

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...