Splunk Dashboard - 'Waiting for Input' error

[shaquibk]

Hi All,

I am stuck with 'Waiting for Input' error for one of the panels that I created in Splunk Dashboard. However, the search runs fine in Search app.

Reading through other similar questions, it seems related to tokens. Tried rectifying it but no good. Following are the search and XML:

Search:

| inputlookup xxxxxxx.csv
| stats dc(title) as number_of_rule, values(title) as rules by category
| map [| inputlookup yyyyyyyy.csv
| eval Date=strftime(_time, \"%m/%d/%Y\")
| eval month=strftime(_time, \"%m\")
| eval current_month=strftime(now(),\"%m\")
| where month=current_month-1
| search index=$$category$$
| stats sum(GB) as GB by index
| eval GB=round(GB,3)
| eval index=\"$$category$$\", number_of_rule=\"$$number_of_rule$$\" | table index, number_of_rule, GB
]

XML:

{

    "type": "ds.search",

    "options": {

        "query": "| inputlookup xxxxxxx.csv\r\n| stats dc(title) as number_of_rule, values(title) as rules by category\r\n| map [| inputlookup yyyyyyyyy.csv\r\n| eval Date=strftime(_time, \\\"%m/%d/%Y\\\")\r\n| eval month=strftime(_time, \\\"%m\\\")\r\n| eval current_month=strftime(now(),\\\"%m\\\")\r\n| where month=current_month-1\r\n| search index=$$category$$\r\n| stats sum(GB) as GB by index\r\n| eval GB=round(GB,3)\r\n| eval index=\\\"$$category$$\\\", number_of_rule=\\\"$$number_of_rule$$\\\" | table index, number_of_rule, GB\r\n]"

    },

    "name": "Search_8"

}

Thanks in advance!

[ITWhisperer]

As you tag suggests, it looks like you have created the dashboard with Dashboard Studio; this is also evident from what you have called "XML" - this is in fact JSON format definition of part of the dashboard source. Your search requires two tokens to be set (category and number_of_rule). It is these that splunk is waiting for. Where in your dashboard are you setting these? Or are you expecting them to be passed in when the dashboard is launched?

[shaquibk]

Update - Running the same search in classic dashboard works as expected. Used double '$$' sign for variables of the map command. 

Issue is specific to dashboard created via Dashboard studio

[richgalloway · Accepted solution]

It appears to be a known limitation of Dashboard Studio.  Per https://docs.splunk.com/Documentation/Splunk/8.2.1/DashStudio/IntroFrame#Compare_classic_Splunk_Dash...:

If you are using the Splunk Dashboards Studio, tokens can only be generated using inputs. Tokens are not set when a dashboard loads. You cannot set token values as a result of a search.

[ITWhisperer]

At the moment, there are a number of limitations with Dashboard Studio that make developing a lot of dashboards untenable and using SimpleXML dashboards is probably the best way for now, imho. Obviously, look out for updates to the Dashboard Studio as these limitations will hopefully eventually be resolved.

[shaquibk]

Thanks for the help guys!

[shaquibk]

Hi @ITWhisperer 

You are correct about dashboard being created via Dashboard Studio. However, the two tokes  (category and number_of_rule) are not to be taken from form input. They are just variables used in the 'Map' command. Hence haven't initialized/set them anywhere separately.

I tried this - https://community.splunk.com/t5/Dashboards-Visualizations/Why-is-the-quot-map-quot-command-not-worki...

But having same error.

[shaquibk]

Hi,

Where do you suggest to check the dashboard source? In the XML code for complete dashboard, I did not find any <form> or <dashboard> tag. 

However,  there is no form input in my dashboard. Just some panels with some standard searches. 

Also, earlier I had put single $ sign and got the same error. But as per Splunk documentation, when using map command, we should user double $$ for variables, hence changed it to double. Anyway, both are giving the same result.

Thanks

[richgalloway]

The Simple XML for the dashboard will start with one of those two words.  Click Edit->Source to view it.  If you have something else then please share.

That you had already tried single $ would have been something good to include in the OP.  😉

[richgalloway]

Does your dashboard source start with <form> or <dashboard>?  If the latter, as I suspect, then replace the double $ with single $.