Dashboards & Visualizations

Token Not Binding with Dropdown on Dashboard

bmkaiser
Explorer

I'm trying to build a dashboard element that will take input from a dropdown field and perform a search based on the item selected from the dashboard. No matter what I try, the search doesn't seem to take to the dropdown selection. I'm not writing this in XML, I'm just trying to use the dashboard wizard to build the panel. Nonetheless, here's what the XML looks like:

<fieldset submitButton="false">
    <input type="dropdown" token="appName" searchWhenChanged="true">
      <label>App Name</label>
      <search>
        <query>| DBQUERY ... | SEARCH DisplayName = $appName$ ...</query>
        <earliest>@d</earliest>
        <latest>now</latest>
      </search>
      <fieldForLabel>Label</fieldForLabel>
      <fieldForValue>Value</fieldForValue>
      <choice value="App Name">App Name</choice>
      <default>App Name</default>
    </input>
  </fieldset>

I've also tried wrapping my token in quotes like below based on another Splunk question that I came across, but it didn't seem to make a difference:

<query>| DBQUERY ... | SEARCH DisplayName = "$appName$" ...</query

Thank you in advance for your help.

0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi bmkaiser,

you're using the token of the drop down in its populating search; this will not work.
The token $appName$ can only be used in panel searches in your dashboard like this:

index=db_foo thisDBapp=$appName$ | ...

For the drop down replace the query line with this:

<query>| DBQUERY ... | SEARCH DisplayName = * ...</query>

and it should work.

Hope this helps ...

cheers, MuS

View solution in original post

MuS
SplunkTrust
SplunkTrust

Hi bmkaiser,

you're using the token of the drop down in its populating search; this will not work.
The token $appName$ can only be used in panel searches in your dashboard like this:

index=db_foo thisDBapp=$appName$ | ...

For the drop down replace the query line with this:

<query>| DBQUERY ... | SEARCH DisplayName = * ...</query>

and it should work.

Hope this helps ...

cheers, MuS

bmkaiser
Explorer

Thank you, but I'm not quite sure I understand. The DBQUERY is really what does the searching for the panel search. So what I think you're saying is that I should remove the SEARCH command from my panel search and replace it with what you have above. Is this right?

The dropdown query would look like this:
| Search DisplayName=$appName$

But I'm not sure how to change the panel query

0 Karma

somesoni2
SplunkTrust
SplunkTrust

The sample xml you provided is for a dropdown, not the panel (defined inside 'fieldset'). And what @MuS is saying that you can't use the token in the same search which defines it. You should have a panel search, outside fieldset and you'd be able to use this token in panel search.

bmkaiser
Explorer

Is this right, then?

<fieldset submitButton="false">
    <input type="dropdown" token="appName" searchWhenChanged="true">
      <label>Select App from List</label>
      <choice value="App Name">App Name</choice>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <title>App Panel</title>
        <search>
          <query>| DBQUERY ... | SEARCH "App Name" = "$appName$" ...</query>
          <earliest>@d</earliest>
          <latest>now</latest>
        </search>
0 Karma

somesoni2
SplunkTrust
SplunkTrust

Syntax wise this is right. Do you intend to have a hard-coded application name in the dropdown? Will it have just one value?

See how the splunk dashboard with form input looks like here
http://docs.splunk.com/Documentation/Splunk/6.2.5/Viz/PanelreferenceforSimplifiedXML

bmkaiser
Explorer

Thank you for the resource! I'll look through to see what I can learn.

I plan to have multiple values. They may be hard coded, but it would be ideal if the list were populated with all of the app names based on a different query.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...