The following dashboard is not updating panels when a different option is selected in the drop-down. It only works on initial load -- any ideas? Is there a way to trigger the base search to run again if a drop-down input is changed?
<form>
<label>Azure Billing</label>
<search id="basebillingsearch">
<query>index=test sourcetype=azure:billing | fields *</query>
<earliest>$earliestdate$</earliest>
<latest>now</latest>
</search>
<fieldset submitButton="false">
<input type="dropdown" token="billingperiodselected" searchWhenChanged="true">
<label>Billing Period</label>
<fieldForLabel>billingperiod</fieldForLabel>
<fieldForValue>billingperiod</fieldForValue>
<search>
<query>index=test sourcetype=azure:billing | rex field=properties.billingPeriodId (?:\/subscriptions\/oursubid\/providers\/Microsoft\.Billing\/billingPeriods\/)(?<billingperiod>\d+) | rex field=billingperiod (?<year>\d{4})(?<month>\d{2})(?<day>\d{2}) | eval earliestdate=month."/".day."/".year." 00:00:00" | eval earliestdate = strptime('earliestdate', "%m/%d/%Y %H:%M:%S") | dedup billingperiod | fields * </query>
<done>
<set token="earliestdate">$result.earliestdate$</set>
</done>
</search>
</input>
</fieldset>
<row>
<panel>
<title>Overall Azure Cost for billing period</title>
<chart>
<search base="basebillingsearch" depends="$billingperiodselected$" >
<query>| timechart sum("properties.pretaxCost") span=1d | rename "sum(properties.pretaxCost)" as "Azure Cost (US)"</query>
</search>
<option name="charting.chart">line</option>
</chart>
</panel>
<panel>
<title>Overall Azure Cost by Azure Service (Top 10)</title>
<chart>
<search base="basebillingsearch">
<query>| timechart sum("properties.pretaxCost") span=1d by "properties.consumedService" limit=10 useother=f | rename "sum(properties.pretaxCost)" as "Azure Cost (US)"</query>
</search>
<option name="charting.chart">line</option>
</chart>
</panel>
<panel>
<title>Total Cost for Billing Period</title>
<table>
<search base="basebillingsearch">
<query>|stats sum("properties.pretaxCost") as "Azure Total Cost (US)" | eval "Azure Total Cost (US)"=round('Azure Total Cost (US)',2)</query>
</search>
</table>
</panel>
</row>
</form>
Hi,
Can you try this, i add billingperiodselected field to detect change :
<form>
<label>Azure Billing</label>
<search id="basebillingsearch">
<query>index=test sourcetype=azure:billing | **eval billingperiodselected="$billingperiodselected$"** | fields *</query>
<earliest>$earliestdate$</earliest>
<latest>now</latest>
</search>
<fieldset submitButton="false">
<input type="dropdown" token="billingperiodselected" searchWhenChanged="true">
<label>Billing Period</label>
<fieldForLabel>billingperiod</fieldForLabel>
<fieldForValue>billingperiod</fieldForValue>
<search>
<query>index=test sourcetype=azure:billing | rex field=properties.billingPeriodId (?:\/subscriptions\/oursubid\/providers\/Microsoft\.Billing\/billingPeriods\/)(?<billingperiod>\d+) | rex field=billingperiod (?<year>\d{4})(?<month>\d{2})(?<day>\d{2}) | eval earliestdate=month."/".day."/".year." 00:00:00" | eval earliestdate = strptime('earliestdate', "%m/%d/%Y %H:%M:%S") | dedup billingperiod | fields * </query>
<done>
<set token="earliestdate">$result.earliestdate$</set>
</done>
</search>
</input>
</fieldset>
<row>
<panel>
<title>Overall Azure Cost for billing period</title>
<chart>
<search base="basebillingsearch" depends="$billingperiodselected$" >
<query>| timechart sum("properties.pretaxCost") span=1d | rename "sum(properties.pretaxCost)" as "Azure Cost (US)"</query>
</search>
<option name="charting.chart">line</option>
</chart>
</panel>
<panel>
<title>Overall Azure Cost by Azure Service (Top 10)</title>
<chart>
<search base="basebillingsearch">
<query>| timechart sum("properties.pretaxCost") span=1d by "properties.consumedService" limit=10 useother=f | rename "sum(properties.pretaxCost)" as "Azure Cost (US)"</query>
</search>
<option name="charting.chart">line</option>
</chart>
</panel>
<panel>
<title>Total Cost for Billing Period</title>
<table>
<search base="basebillingsearch">
<query>|stats sum("properties.pretaxCost") as "Azure Total Cost (US)" | eval "Azure Total Cost (US)"=round('Azure Total Cost (US)',2)</query>
</search>
</table>
</panel>
</row>
</form>
Hi,
I have checked your dashboard XML, the token billingperiodselected
is not being used in search query.
Hence you will see no updates on the dashboard after changing the value from the dropdown.
The toke is being used for the depends
parameter for a search
tag.
depends
is used to dynamically manage visibility of any panel in the dashboard. It has nothing to do with the value of the token.
Also, using it with search
tag doesn't make any sense. If you want to change the results the token should be used in search query.
For more details, refer the following documentation.
https://docs.splunk.com/Documentation/Splunk/8.0.1/Viz/ContextualDrilldown#Show_or_hide_content
accept and upvote the answer if it helps.
I'm having the same issue.
when I updated the form inputs, my panel search is not refreshing.