Dashboards & Visualizations

Splunk Dashboard - 'Waiting for Input' error

shaquibk
Explorer

Hi All,

I am stuck with 'Waiting for Input' error for one of the panels that I created in Splunk Dashboard. However, the search runs fine in Search app.

Reading through other similar questions, it seems related to tokens. Tried rectifying it but no good. Following are the search and XML:

Search:

| inputlookup xxxxxxx.csv
| stats dc(title) as number_of_rule, values(title) as rules by category
| map [| inputlookup yyyyyyyy.csv
| eval Date=strftime(_time, \"%m/%d/%Y\")
| eval month=strftime(_time, \"%m\")
| eval current_month=strftime(now(),\"%m\")
| where month=current_month-1
| search index=$$category$$
| stats sum(GB) as GB by index
| eval GB=round(GB,3)
| eval index=\"$$category$$\", number_of_rule=\"$$number_of_rule$$\" | table index, number_of_rule, GB
]

 

XML:

{
    "type": "ds.search",
    "options": {
        "query": "| inputlookup xxxxxxx.csv\r\n| stats dc(title) as number_of_rule, values(title) as rules by category\r\n| map [| inputlookup yyyyyyyyy.csv\r\n| eval Date=strftime(_time, \\\"%m/%d/%Y\\\")\r\n| eval month=strftime(_time, \\\"%m\\\")\r\n| eval current_month=strftime(now(),\\\"%m\\\")\r\n| where month=current_month-1\r\n| search index=$$category$$\r\n| stats sum(GB) as GB by index\r\n| eval GB=round(GB,3)\r\n| eval index=\\\"$$category$$\\\", number_of_rule=\\\"$$number_of_rule$$\\\" | table index, number_of_rule, GB\r\n]"
    },
    "name": "Search_8"
}
 
Thanks in advance!
Labels (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

It appears to be a known limitation of Dashboard Studio.  Per https://docs.splunk.com/Documentation/Splunk/8.2.1/DashStudio/IntroFrame#Compare_classic_Splunk_Dash...:

If you are using the Splunk Dashboards Studio, tokens can only be generated using inputs. Tokens are not set when a dashboard loads. You cannot set token values as a result of a search.

 

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

ITWhisperer
Legend

As you tag suggests, it looks like you have created the dashboard with Dashboard Studio; this is also evident from what you have called "XML" - this is in fact JSON format definition of part of the dashboard source. Your search requires two tokens to be set (category and number_of_rule). It is these that splunk is waiting for. Where in your dashboard are you setting these? Or are you expecting them to be passed in when the dashboard is launched?

0 Karma

shaquibk
Explorer

Update - Running the same search in classic dashboard works as expected. Used double '$$' sign for variables of the map command. 

Issue is specific to dashboard created via Dashboard studio

0 Karma

richgalloway
SplunkTrust
SplunkTrust

It appears to be a known limitation of Dashboard Studio.  Per https://docs.splunk.com/Documentation/Splunk/8.2.1/DashStudio/IntroFrame#Compare_classic_Splunk_Dash...:

If you are using the Splunk Dashboards Studio, tokens can only be generated using inputs. Tokens are not set when a dashboard loads. You cannot set token values as a result of a search.

 

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

ITWhisperer
Legend

At the moment, there are a number of limitations with Dashboard Studio that make developing a lot of dashboards untenable and using SimpleXML dashboards is probably the best way for now, imho. Obviously, look out for updates to the Dashboard Studio as these limitations will hopefully eventually be resolved.

0 Karma

shaquibk
Explorer

Thanks for the help guys!

0 Karma

shaquibk
Explorer

Hi @ITWhisperer 

You are correct about dashboard being created via Dashboard Studio. However, the two tokes  (category and number_of_rule) are not to be taken from form input. They are just variables used in the 'Map' command. Hence haven't initialized/set them anywhere separately.

I tried this - https://community.splunk.com/t5/Dashboards-Visualizations/Why-is-the-quot-map-quot-command-not-worki...

But having same error.

 

0 Karma

shaquibk
Explorer

Hi,

Where do you suggest to check the dashboard source? In the XML code for complete dashboard, I did not find any <form> or <dashboard> tag. 

However,  there is no form input in my dashboard. Just some panels with some standard searches. 

Also, earlier I had put single $ sign and got the same error. But as per Splunk documentation, when using map command, we should user double $$ for variables, hence changed it to double. Anyway, both are giving the same result.

Thanks

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The Simple XML for the dashboard will start with one of those two words.  Click Edit->Source to view it.  If you have something else then please share.

That you had already tried single $ would have been something good to include in the OP.  😉

---
If this reply helps you, an upvote would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Does your dashboard source start with <form> or <dashboard>?  If the latter, as I suspect, then replace the double $ with single $.

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.