Dashboards & Visualizations

Is it possible to set the sampleRatio for a search using a drop-down token with XML?

dbcase
Motivator

Hi,

I have the below XML code. What I'm trying to do is use a drop-down so the user can select a sampling ratio for the query. Splunk complains with this error message. Is it possible to use a drop-down to set the sampling ratio?

XML Syntax Error: invalid literal for int() with base 10: "'$compare_mso_sample$'"



<input type="dropdown" token="compare_mso_sample" searchWhenChanged="true">
        <label>Select a Sampling Ratio:</label>
        <default>1:100</default>
        <choice value="0">0 - All Events (Computationally HEAVY)</choice>
        <choice value="10">1:10</choice>
        <choice value="25">1:25</choice>
        <choice value="50">1:50</choice>
        <choice value="75">1:75</choice>
        <choice value="100">1:100</choice>
        <choice value="150">1:150</choice>
        <choice value="200">1:200</choice>
        <choice value="300">1:300</choice>
        <choice value="500">1:500</choice>
        <choice value="750">1:750</choice>
        <choice value="1000">1:1000</choice>
        <choice value="5000">1:5000</choice>
      </input>
      <table>
      <title>BEA Codes for $time_field.earliest$</title>

        <search>
          <query>index="$mso_environment$" sourcetype=wls_managedserver | lookup beacodes.csv beacode as bea_code|chart values(desc) as Description sparkline(count(bea_code)) as Trend count(bea_code) as "BEA Code Count" by bea_code|sort -"BEA Code Count"|rename bea_code as "BEA CODE - Click for Detail"</query>
          <earliest>$time_field_mso.earliest$</earliest>
          <latest>$time_field_mso.latest$</latest>
           <sampleRatio>'$compare_mso_sample$'</sampleRatio>
0 Karma
1 Solution

maciep
Champion

I was able to do it on 6.5 on my test machine (windows 10). Have you tried removing the single quotes surrounding your token? Not sure why those are there?

Here is what I have:

<form>
  <label>sampling test</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="t_ratio" searchWhenChanged="true">
      <label>Ratio</label>
      <default>100</default>
      <choice value="0">0 - All Events (Computationally HEAVY)</choice>
      <choice value="10">1:10</choice>
      <choice value="25">1:25</choice>
      <choice value="50">1:50</choice>
      <choice value="75">1:75</choice>
      <choice value="100">1:100</choice>
      <choice value="150">1:150</choice>
      <choice value="200">1:200</choice>
      <choice value="300">1:300</choice>
      <choice value="500">1:500</choice>
      <choice value="750">1:750</choice>
      <choice value="1000">1:1000</choice>
      <choice value="5000">1:5000</choice>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>index=wineventlog earliest=@d | table _time, EventCode</query>
          <earliest>$earliest$</earliest>
          <latest>$latest$</latest>
          <sampleRatio>$t_ratio$</sampleRatio>
        </search>
      </table>
    </panel>
  </row>
</form>

View solution in original post

maciep
Champion

I was able to do it on 6.5 on my test machine (windows 10). Have you tried removing the single quotes surrounding your token? Not sure why those are there?

Here is what I have:

<form>
  <label>sampling test</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="t_ratio" searchWhenChanged="true">
      <label>Ratio</label>
      <default>100</default>
      <choice value="0">0 - All Events (Computationally HEAVY)</choice>
      <choice value="10">1:10</choice>
      <choice value="25">1:25</choice>
      <choice value="50">1:50</choice>
      <choice value="75">1:75</choice>
      <choice value="100">1:100</choice>
      <choice value="150">1:150</choice>
      <choice value="200">1:200</choice>
      <choice value="300">1:300</choice>
      <choice value="500">1:500</choice>
      <choice value="750">1:750</choice>
      <choice value="1000">1:1000</choice>
      <choice value="5000">1:5000</choice>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>index=wineventlog earliest=@d | table _time, EventCode</query>
          <earliest>$earliest$</earliest>
          <latest>$latest$</latest>
          <sampleRatio>$t_ratio$</sampleRatio>
        </search>
      </table>
    </panel>
  </row>
</form>

dbcase
Motivator

Interesting, must be a 6.5 thing. I'm on 6.4. Time to upgrade!

0 Karma

somesoni2
SplunkTrust
SplunkTrust

I had similar requirement for setting number of rows displayed in single page of table visualization and couldn't make it work. The reason was that tokens are treated as string (when used in search, splunk does implicit convert to number if required, but that doesn't happen on xml tags) and this property requires an integer value.

0 Karma

dbcase
Motivator

Hi Somesoni2,

Thanks for the reply! I'm guessing that there is no way to convert to an integer or have the original value be an integer?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...