Dashboards & Visualizations

Why does my cloned dashboard have "waiting for input" message but the original dashboard is working?

New Member

Hi all somebody can help me?
if I add a clone a dashboard on overview dashboard, I have this result "waiting for input". but I see the original dashboard is working good.
this is my graph

  <title>Top Source IP</title>
  <chart>
    <search>
      <query>| tstats summariesonly=true count FROM datamodel="ftnt_fos" where nodename="log.traffic" $srcip$ $dstip$  $user$ $app$ $vdom$ $device$   $srcintf$ $dstintf$  groupby log.srcip | sort -count | head 20</query>
      <earliest>$time_token.earliest$</earliest>
      <latest>$time_token.latest$</latest>
    </search>
    <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
    <option name="charting.axisLabelsX.majorLabelStyle.rotation">-45</option>
    <option name="charting.axisTitleX.visibility">collapsed</option>
    <option name="charting.axisTitleY.visibility">collapsed</option>
    <option name="charting.axisTitleY2.visibility">visible</option>
    <option name="charting.axisX.scale">linear</option>
    <option name="charting.axisY.scale">linear</option>
    <option name="charting.axisY2.enabled">0</option>
    <option name="charting.axisY2.scale">inherit</option>
    <option name="charting.chart">column</option>
    <option name="charting.chart.bubbleMaximumSize">50</option>
    <option name="charting.chart.bubbleMinimumSize">10</option>
    <option name="charting.chart.bubbleSizeBy">area</option>
    <option name="charting.chart.nullValueMode">gaps</option>
    <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
    <option name="charting.chart.stackMode">stacked</option>
    <option name="charting.chart.style">shiny</option>
    <option name="charting.drilldown">all</option>
    <option name="charting.layout.splitSeries">0</option>
    <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
    <option name="charting.legend.placement">none</option>
  </chart>
</panel>

somebody have a solution?
thanks for help

0 Karma

Esteemed Legend

That is not a dashboard, that is a panel. If the dashboard that is hosting that panel does not contain a timepicker that sets time_token as well as other "stuff" that set the srcip, dstip, user, app, vdom, device, srcintf and dstintf tokens, then your panel('s search) will not run.

0 Karma

Communicator

we have the same problem. we have time_token set for timepicker, can you please let me know how to make that work.
Thanks.

0 Karma

Esteemed Legend

The easiest way is to view the dashboard, click Edit, then click the magnifying glass icon whose tooltip says, Edit search, then on the Time Range control, then click Use Time Picker and select Shared Timepicker (time_token), then click the green Apply button, then click the green Save button.

0 Karma

SplunkTrust
SplunkTrust

check permissions on the cloned dashboard?

0 Karma

New Member

hi
how i can control permission?

0 Karma

SplunkTrust
SplunkTrust

click on dashboards on nav bar -> find the cloned dashboard -> click edit -> permissions -> if its private, change to app context.
permissions is a wild guess that works more than 50% of the times in my little experience

0 Karma

New Member

do not work the permission it's ok but when i edit dashboard and want add clone panel i have always the same result waiting for input.

0 Karma