Dashboards & Visualizations
×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
Solved! Jump to solution

Setting a token as a result of an input in a dashboard

matansocher
Contributor
‎11-21-2017 11:35 PM

Hi

I want to set a token in my dashboard after a user has entered an input.

this is my dashboard, after a try (in the 'change' tag, wanted to use the 'teamRegressions' I set and it doesent recognize it in my search):

<form>
  <label>Matan Regressions Test - v1.4</label>
  <fieldset submitButton="true" autoRun="false">
    <input type="dropdown" token="teamTests">
      <label>Team (Mandatory)</label>
      <choice value="TestsMultimediaCSV">camss</choice>
      <choice value="TestsPeriphCSV">periph</choice>
    </input>
    <input type="dropdown" token="groupID">
      <change>
        <eval token="teamRegressions">case($teamTests$=="TestsMultimediaCSV", "RegressionsMultimediaCSV", $teamTests$=="TestsPeriphCSV", "RegressionsCSV")</eval>
      </change>
      <label>Core (Mandatory)</label>
      <prefix>*</prefix>
      <fieldForLabel>groupID</fieldForLabel>
      <fieldForValue>groupID</fieldForValue>
      <search>
        <query>| inputcsv $teamRegressions$
| eval groupID = substr(groupID, 6, len(groupID))
| dedup groupID
| table groupID
| sort groupID</query>
        <earliest>0</earliest>
        <latest></latest>
      </search>
      <suffix>*</suffix>
    </input>
    <input type="dropdown" token="regression_target">
      <label>Chip (Mandatory)</label>
      <choice value="*">All</choice>
      <prefix>*</prefix>
      <fieldForLabel>regression_target</fieldForLabel>
      <fieldForValue>regression_target</fieldForValue>
      <search>
        <query>| inputcsv $teamRegressions$
| search groupID=$groupID$
| dedup regression_target
| table regression_target
| sort regression_target</query>
        <earliest>0</earliest>
        <latest></latest>
      </search>
      <suffix>*</suffix>
    </input>
  </fieldset>
  <row>
    <panel>
      <html>
        <h1>$teamRegressions$</h1>
      </html>
    </panel>
  </row>
  <row>
    <panel>
      <title>Best Regresion per week</title>
      <chart>
        <search>
          <query>| inputcsv $teamTests$ 
| search groupID=$groupID$ regression_target=$regression_target$
| dedup thumb_print test_id

| search 
    [| inputcsv $teamRegressions$ 
    | search groupID=$groupID$ regression_target=$regression_target$ 
    | eval _time = strptime(regression_start_time, "%Y.%m.%d_%H:%M:%S") 
    | eval Day1ofWeek = strftime(relative_time(_time,"@w0"),"%m/%d/%Y") 
    | sort -regression_target -Day1ofWeek -PASS 
    | streamstats count as counter by regression_target Day1ofWeek 
    | where counter <= 1 
    | rename a as "this is a set of thumb_prints of the best regressions from each week" 
    | table thumb_print] 

| eval job_start_time = strftime(job_start_time, "%Y.%m.%d_%H:%M:%S")
| eval job_end_time = strftime(job_end_time, "%Y.%m.%d_%H:%M:%S")
| eval Day1ofWeek = strftime(relative_time(_time,"@w0"),"%m/%d/%Y")
| table _time Day1ofWeek thumb_print test_id state status job_start_time job_end_time 

| fillnull value=0 

| eval _time = strptime(Day1ofWeek, "%m/%d/%Y")
| stats count(eval(status=="INCOMPLETE")) as INCOMPLETE count(eval(status=="INCONCLUSIVE")) as INCONCLUSIVE count(eval(status=="RUNNING")) as RUNNING count(eval(status=="FAIL")) as FAIL count(eval(status=="PASS")) as PASS by Day1ofWeek
| eval "Pass %" = floor((PASS / (PASS+FAIL+INCOMPLETE+INCONCLUSIVE+RUNNING))*100)</query>
          <earliest>-30d@d</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.axisTitleX.text">Date</option>
        <option name="charting.axisTitleY.text">Number Of Tests</option>
        <option name="charting.axisTitleY2.text">Pass %</option>
        <option name="charting.axisY2.enabled">1</option>
        <option name="charting.axisY2.maximumNumber">100</option>
        <option name="charting.axisY2.minimumNumber">0</option>
        <option name="charting.chart">column</option>
        <option name="charting.chart.overlayFields">"Pass %"</option>
        <option name="charting.chart.showDataLabels">all</option>
        <option name="charting.chart.stackMode">stacked</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.fieldColors">{"PASS":10FF00,"FAIL":FF0000,"INCOMPLETE":0015FF,"INCONCLUSIVE":FF00EE,"RUNNING":FF9000,"Pass %":FFEE00}</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.legend.placement">bottom</option>
        <option name="height">500</option>
      </chart>
    </panel>
  </row>
</form>

what am I doing wrong?

Thanks

0 Karma
Reply
1 Solution
Solved! Jump to solution
Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust
‎11-21-2017 11:48 PM

HI

In your dahsboard xml, you are using $teamRegressions$ token on change of "Core (Mandatory)" input. Don't you think it should be on change of "Team (Mandatory)" ?

can you please change these two inputs?

<input type="dropdown" token="teamTests">
       <label>Team (Mandatory)</label>
       <choice value="TestsMultimediaCSV">camss</choice>
       <choice value="TestsPeriphCSV">periph</choice>
       <change>
         <eval token="teamRegressions">case($value$=="TestsMultimediaCSV", "RegressionsMultimediaCSV", $value$=="TestsPeriphCSV", "RegressionsCSV")</eval>
       </change>
     </input>
     <input type="dropdown" token="groupID">
       <label>Core (Mandatory)</label>
       <prefix>*</prefix>
       <fieldForLabel>groupID</fieldForLabel>
       <fieldForValue>groupID</fieldForValue>
       <search>
         <query>| inputcsv $teamRegressions$
 | eval groupID = substr(groupID, 6, len(groupID))
 | dedup groupID
 | table groupID
 | sort groupID</query>
         <earliest>0</earliest>
         <latest></latest>
       </search>
       <suffix>*</suffix>
     </input>

View solution in original post

0 Karma
Reply
Solved! Jump to solution
Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust
‎11-21-2017 11:48 PM

HI

In your dahsboard xml, you are using $teamRegressions$ token on change of "Core (Mandatory)" input. Don't you think it should be on change of "Team (Mandatory)" ?

can you please change these two inputs?

<input type="dropdown" token="teamTests">
       <label>Team (Mandatory)</label>
       <choice value="TestsMultimediaCSV">camss</choice>
       <choice value="TestsPeriphCSV">periph</choice>
       <change>
         <eval token="teamRegressions">case($value$=="TestsMultimediaCSV", "RegressionsMultimediaCSV", $value$=="TestsPeriphCSV", "RegressionsCSV")</eval>
       </change>
     </input>
     <input type="dropdown" token="groupID">
       <label>Core (Mandatory)</label>
       <prefix>*</prefix>
       <fieldForLabel>groupID</fieldForLabel>
       <fieldForValue>groupID</fieldForValue>
       <search>
         <query>| inputcsv $teamRegressions$
 | eval groupID = substr(groupID, 6, len(groupID))
 | dedup groupID
 | table groupID
 | sort groupID</query>
         <earliest>0</earliest>
         <latest></latest>
       </search>
       <suffix>*</suffix>
     </input>
0 Karma
Reply
Solved! Jump to solution

matansocher
Contributor
‎11-22-2017 12:00 AM

Thanks!! I probably did not understand the meaning of the tag

0 Karma
Reply
Solved! Jump to solution

kamlesh_vaghela
SplunkTrust
SplunkTrust
‎11-22-2017 12:11 AM

oops. I just mistyped token name. My answer is updated. can you please try it?

0 Karma
Reply
Solved! Jump to solution

matansocher
Contributor
‎11-22-2017 12:17 AM

it did work

0 Karma
Reply
Solved! Jump to solution

niketn
Legend
‎11-22-2017 12:27 AM

@matansocher, please accept the answer by Kamlesh if it has resolved your issue.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Reply
Get Updates on the Splunk Community!

Index This | When is October more than just the tenth month?

October 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What’s New & Next in Splunk SOAR

 Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us for an ...