Dashboards & Visualizations

Why are changes based on drop-down input in panels not updating in the following dashboard?

Kendo213
Communicator

The following dashboard is not updating panels when a different option is selected in the drop-down. It only works on initial load -- any ideas? Is there a way to trigger the base search to run again if a drop-down input is changed?

<form>
  <label>Azure Billing</label>
  <search id="basebillingsearch">
    <query>index=test sourcetype=azure:billing | fields *</query>
    <earliest>$earliestdate$</earliest>
    <latest>now</latest>
  </search>
  <fieldset submitButton="false">
    <input type="dropdown" token="billingperiodselected" searchWhenChanged="true">
      <label>Billing Period</label>
      <fieldForLabel>billingperiod</fieldForLabel>
      <fieldForValue>billingperiod</fieldForValue>
      <search>
        <query>index=test sourcetype=azure:billing | rex field=properties.billingPeriodId (?:\/subscriptions\/oursubid\/providers\/Microsoft\.Billing\/billingPeriods\/)(?<billingperiod>\d+) | rex field=billingperiod (?<year>\d{4})(?<month>\d{2})(?<day>\d{2}) | eval earliestdate=month."/".day."/".year." 00:00:00" | eval earliestdate = strptime('earliestdate', "%m/%d/%Y %H:%M:%S") | dedup billingperiod | fields * </query>
        <done>
          <set token="earliestdate">$result.earliestdate$</set>
        </done>
      </search>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>Overall Azure Cost for billing period</title>
      <chart>
        <search base="basebillingsearch" depends="$billingperiodselected$" >
          <query>| timechart sum("properties.pretaxCost") span=1d | rename "sum(properties.pretaxCost)" as "Azure Cost (US)"</query>
        </search>
        <option name="charting.chart">line</option>
      </chart>
    </panel>
    <panel>
      <title>Overall Azure Cost by Azure Service (Top 10)</title>
      <chart>
        <search base="basebillingsearch">
          <query>| timechart sum("properties.pretaxCost") span=1d by "properties.consumedService" limit=10 useother=f | rename "sum(properties.pretaxCost)" as "Azure Cost (US)"</query>
        </search>
        <option name="charting.chart">line</option>
      </chart>
    </panel>
        <panel>
      <title>Total Cost for Billing Period</title>
      <table>
        <search base="basebillingsearch">
          <query>|stats sum("properties.pretaxCost") as "Azure Total Cost (US)" | eval "Azure Total Cost (US)"=round('Azure Total Cost (US)',2)</query>
        </search>
        </table>
    </panel>
  </row>
</form>
0 Karma

TISKAR
Builder

Hi,

Can you try this, i add billingperiodselected field to detect change :

<form>
   <label>Azure Billing</label>
   <search id="basebillingsearch">
     <query>index=test sourcetype=azure:billing | **eval billingperiodselected="$billingperiodselected$"** | fields *</query>
     <earliest>$earliestdate$</earliest>
     <latest>now</latest>
   </search>
   <fieldset submitButton="false">
     <input type="dropdown" token="billingperiodselected" searchWhenChanged="true">
       <label>Billing Period</label>
       <fieldForLabel>billingperiod</fieldForLabel>
       <fieldForValue>billingperiod</fieldForValue>
       <search>
         <query>index=test sourcetype=azure:billing | rex field=properties.billingPeriodId (?:\/subscriptions\/oursubid\/providers\/Microsoft\.Billing\/billingPeriods\/)(?<billingperiod>\d+) | rex field=billingperiod (?<year>\d{4})(?<month>\d{2})(?<day>\d{2}) | eval earliestdate=month."/".day."/".year." 00:00:00" | eval earliestdate = strptime('earliestdate', "%m/%d/%Y %H:%M:%S") | dedup billingperiod | fields * </query>
         <done>
           <set token="earliestdate">$result.earliestdate$</set>
         </done>
       </search>
     </input>
   </fieldset>
   <row>
     <panel>
       <title>Overall Azure Cost for billing period</title>
       <chart>
         <search base="basebillingsearch" depends="$billingperiodselected$" >
           <query>| timechart sum("properties.pretaxCost") span=1d | rename "sum(properties.pretaxCost)" as "Azure Cost (US)"</query>
         </search>
         <option name="charting.chart">line</option>
       </chart>
     </panel>
     <panel>
       <title>Overall Azure Cost by Azure Service (Top 10)</title>
       <chart>
         <search base="basebillingsearch">
           <query>| timechart sum("properties.pretaxCost") span=1d by "properties.consumedService" limit=10 useother=f | rename "sum(properties.pretaxCost)" as "Azure Cost (US)"</query>
         </search>
         <option name="charting.chart">line</option>
       </chart>
     </panel>
         <panel>
       <title>Total Cost for Billing Period</title>
       <table>
         <search base="basebillingsearch">
           <query>|stats sum("properties.pretaxCost") as "Azure Total Cost (US)" | eval "Azure Total Cost (US)"=round('Azure Total Cost (US)',2)</query>
         </search>
         </table>
     </panel>
   </row>
 </form>
0 Karma

gaurav_maniar
Builder

Hi,

I have checked your dashboard XML, the token billingperiodselected is not being used in search query.
Hence you will see no updates on the dashboard after changing the value from the dropdown.

The toke is being used for the depends parameter for a search tag.
depends is used to dynamically manage visibility of any panel in the dashboard. It has nothing to do with the value of the token.
Also, using it with search tag doesn't make any sense. If you want to change the results the token should be used in search query.

For more details, refer the following documentation.
https://docs.splunk.com/Documentation/Splunk/8.0.1/Viz/ContextualDrilldown#Show_or_hide_content

accept and upvote the answer if it helps.

0 Karma

chiennylin
New Member

I'm having the same issue.
when I updated the form inputs, my panel search is not refreshing.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...