Is it possible to set the sampleRatio for a search using a drop-down token with XML?

[dbcase]

Hi,

I have the below XML code. What I'm trying to do is use a drop-down so the user can select a sampling ratio for the query. Splunk complains with this error message. Is it possible to use a drop-down to set the sampling ratio?

XML Syntax Error: invalid literal for int() with base 10: "'$compare_mso_sample$'"



<input type="dropdown" token="compare_mso_sample" searchWhenChanged="true">
        <label>Select a Sampling Ratio:</label>
        <default>1:100</default>
        <choice value="0">0 - All Events (Computationally HEAVY)</choice>
        <choice value="10">1:10</choice>
        <choice value="25">1:25</choice>
        <choice value="50">1:50</choice>
        <choice value="75">1:75</choice>
        <choice value="100">1:100</choice>
        <choice value="150">1:150</choice>
        <choice value="200">1:200</choice>
        <choice value="300">1:300</choice>
        <choice value="500">1:500</choice>
        <choice value="750">1:750</choice>
        <choice value="1000">1:1000</choice>
        <choice value="5000">1:5000</choice>
      </input>
      <table>
      <title>BEA Codes for $time_field.earliest$</title>

        <search>
          <query>index="$mso_environment$" sourcetype=wls_managedserver | lookup beacodes.csv beacode as bea_code|chart values(desc) as Description sparkline(count(bea_code)) as Trend count(bea_code) as "BEA Code Count" by bea_code|sort -"BEA Code Count"|rename bea_code as "BEA CODE - Click for Detail"</query>
          <earliest>$time_field_mso.earliest$</earliest>
          <latest>$time_field_mso.latest$</latest>
           <sampleRatio>'$compare_mso_sample$'</sampleRatio>

[maciep · Accepted solution]

I was able to do it on 6.5 on my test machine (windows 10). Have you tried removing the single quotes surrounding your token? Not sure why those are there?

Here is what I have:

<form>
  <label>sampling test</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="t_ratio" searchWhenChanged="true">
      <label>Ratio</label>
      <default>100</default>
      <choice value="0">0 - All Events (Computationally HEAVY)</choice>
      <choice value="10">1:10</choice>
      <choice value="25">1:25</choice>
      <choice value="50">1:50</choice>
      <choice value="75">1:75</choice>
      <choice value="100">1:100</choice>
      <choice value="150">1:150</choice>
      <choice value="200">1:200</choice>
      <choice value="300">1:300</choice>
      <choice value="500">1:500</choice>
      <choice value="750">1:750</choice>
      <choice value="1000">1:1000</choice>
      <choice value="5000">1:5000</choice>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>index=wineventlog earliest=@d | table _time, EventCode</query>
          <earliest>$earliest$</earliest>
          <latest>$latest$</latest>
          <sampleRatio>$t_ratio$</sampleRatio>
        </search>
      </table>
    </panel>
  </row>
</form>

[dbcase]

Interesting, must be a 6.5 thing. I'm on 6.4. Time to upgrade!

[somesoni2]

I had similar requirement for setting number of rows displayed in single page of table visualization and couldn't make it work. The reason was that tokens are treated as string (when used in search, splunk does implicit convert to number if required, but that doesn't happen on xml tags) and this property requires an integer value.

[dbcase]

Hi Somesoni2,

Thanks for the reply! I'm guessing that there is no way to convert to an integer or have the original value be an integer?