Dashboards & Visualizations

Select "All" option in dropdown doesnot work

Megha
Explorer

Hi, 

I have a simple dropdown with 3 options All, AA and BB. When I select AA/BB I am getting correct results however when I select "All" it says "No search results returned". Not sure where I am doing wrong, can anyone help me solving this issue.

  

"input_iUKfLZBh": {
            "options": {
                "items": [
                    {
                        "label": "AA",
                        "value": "AA"
                    },
                    {
                        "label": "BB",
                        "value": "BB"
                    },
                    {
                        "label": "All",
                        "value": "*"
                    }
                ],
                "token": "Config_type",
                "defaultValue": "AA"
            },
            "title": "Select Error Type",
            "type": "input.dropdown"
        }

Megha_0-1712260709750.png

 

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

The where command doesn't support wildcards in the same way as search. Either change where to search or change the dropdown to include the whole command line apart from the "All" option where it should be blank.

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

How are you using the token in your search?

0 Karma

Megha
Explorer

Thank you for replying.

I am using the token in the chain search.

Megha_0-1712324305617.png

Megha_1-1712324386317.png

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

The where command doesn't support wildcards in the same way as search. Either change where to search or change the dropdown to include the whole command line apart from the "All" option where it should be blank.

Megha
Explorer

It worked, thank you so much!

But I need one more help. I have another dashboard with a dropdown and two line graphs showing Response-Time and Counts. The base search used for both the graphs is exactly same however the chain search's are little different where one calculates the average response time and other calculates counts for the same. But the counts graph works perfectly however the response time only shows for one selection("All" is selected in dropdown). Please help me in finding the issue. 

Megha_1-1712329730421.png

Megha_3-1712329786128.png

 

Megha_0-1712329700684.png

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try without the rounding

| timechart span=1m avg(ResponseTime) by API_Name
0 Karma

Megha
Explorer

Hi, I have removed the round function in chain search but it is still showing the same graph.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You have an orange triangle warning symbol in the top right of your chart. What does this message say?

0 Karma

Megha
Explorer

Warning: "This usually indicates problems with underlying storage performance."

But this warning is showing for other graph too.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try changing the timeframe for the search to a shorter time frame - does the graph work then?

0 Karma

Megha
Explorer

Yes, I have tried diff timeframes (Last 15minutes option too) but no luck. Actually, my agenda is to find the response time and counts for the same time frame.  If we are seeing the counts then by default it should show the response time too.

But when I click on magnifying glass icon(open in search) in view mode it is giving results for other API's too.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Does it work if you create two base searches rather than 1 base search and two chained searches?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Another option you could try is converting the dashboard to Classic

0 Karma

Megha
Explorer

Hi, my issue got resolved. It's weird but I have tried changing different "Visualization Type" and to my surprise Line chart suddenly started populating graphs for all the options I have selected in the dropdown.  

0 Karma

Megha
Explorer

Tried changing to different base search and it did not work.  My dashboard has other graphs too so changing to classic is big task, but will sure give a try, Thank you!

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...