Dashboards & Visualizations

Why does my cloned dashboard have "waiting for input" message but the original dashboard is working?

skyluke70
New Member

Hi all somebody can help me?
if I add a clone a dashboard on overview dashboard, I have this result "waiting for input". but I see the original dashboard is working good.
this is my graph

  <title>Top Source IP</title>
  <chart>
    <search>
      <query>| tstats summariesonly=true count FROM datamodel="ftnt_fos" where nodename="log.traffic" $srcip$ $dstip$  $user$ $app$ $vdom$ $device$   $srcintf$ $dstintf$  groupby log.srcip | sort -count | head 20</query>
      <earliest>$time_token.earliest$</earliest>
      <latest>$time_token.latest$</latest>
    </search>
    <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
    <option name="charting.axisLabelsX.majorLabelStyle.rotation">-45</option>
    <option name="charting.axisTitleX.visibility">collapsed</option>
    <option name="charting.axisTitleY.visibility">collapsed</option>
    <option name="charting.axisTitleY2.visibility">visible</option>
    <option name="charting.axisX.scale">linear</option>
    <option name="charting.axisY.scale">linear</option>
    <option name="charting.axisY2.enabled">0</option>
    <option name="charting.axisY2.scale">inherit</option>
    <option name="charting.chart">column</option>
    <option name="charting.chart.bubbleMaximumSize">50</option>
    <option name="charting.chart.bubbleMinimumSize">10</option>
    <option name="charting.chart.bubbleSizeBy">area</option>
    <option name="charting.chart.nullValueMode">gaps</option>
    <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
    <option name="charting.chart.stackMode">stacked</option>
    <option name="charting.chart.style">shiny</option>
    <option name="charting.drilldown">all</option>
    <option name="charting.layout.splitSeries">0</option>
    <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
    <option name="charting.legend.placement">none</option>
  </chart>
</panel>

somebody have a solution?
thanks for help

0 Karma

woodcock
Esteemed Legend

That is not a dashboard, that is a panel. If the dashboard that is hosting that panel does not contain a timepicker that sets time_token as well as other "stuff" that set the srcip, dstip, user, app, vdom, device, srcintf and dstintf tokens, then your panel('s search) will not run.

0 Karma

sathwikr076
Communicator

we have the same problem. we have time_token set for timepicker, can you please let me know how to make that work.
Thanks.

0 Karma

woodcock
Esteemed Legend

The easiest way is to view the dashboard, click Edit, then click the magnifying glass icon whose tooltip says, Edit search, then on the Time Range control, then click Use Time Picker and select Shared Timepicker (time_token), then click the green Apply button, then click the green Save button.

0 Karma

adonio
Ultra Champion

check permissions on the cloned dashboard?

0 Karma

skyluke70
New Member

hi
how i can control permission?

0 Karma

adonio
Ultra Champion

click on dashboards on nav bar -> find the cloned dashboard -> click edit -> permissions -> if its private, change to app context.
permissions is a wild guess that works more than 50% of the times in my little experience

0 Karma

skyluke70
New Member

do not work the permission it's ok but when i edit dashboard and want add clone panel i have always the same result waiting for input.

0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...