Dashboards & Visualizations

Why does my cloned dashboard have "waiting for input" message but the original dashboard is working?

skyluke70
New Member

Hi all somebody can help me?
if I add a clone a dashboard on overview dashboard, I have this result "waiting for input". but I see the original dashboard is working good.
this is my graph

  <title>Top Source IP</title>
  <chart>
    <search>
      <query>| tstats summariesonly=true count FROM datamodel="ftnt_fos" where nodename="log.traffic" $srcip$ $dstip$  $user$ $app$ $vdom$ $device$   $srcintf$ $dstintf$  groupby log.srcip | sort -count | head 20</query>
      <earliest>$time_token.earliest$</earliest>
      <latest>$time_token.latest$</latest>
    </search>
    <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
    <option name="charting.axisLabelsX.majorLabelStyle.rotation">-45</option>
    <option name="charting.axisTitleX.visibility">collapsed</option>
    <option name="charting.axisTitleY.visibility">collapsed</option>
    <option name="charting.axisTitleY2.visibility">visible</option>
    <option name="charting.axisX.scale">linear</option>
    <option name="charting.axisY.scale">linear</option>
    <option name="charting.axisY2.enabled">0</option>
    <option name="charting.axisY2.scale">inherit</option>
    <option name="charting.chart">column</option>
    <option name="charting.chart.bubbleMaximumSize">50</option>
    <option name="charting.chart.bubbleMinimumSize">10</option>
    <option name="charting.chart.bubbleSizeBy">area</option>
    <option name="charting.chart.nullValueMode">gaps</option>
    <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
    <option name="charting.chart.stackMode">stacked</option>
    <option name="charting.chart.style">shiny</option>
    <option name="charting.drilldown">all</option>
    <option name="charting.layout.splitSeries">0</option>
    <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
    <option name="charting.legend.placement">none</option>
  </chart>
</panel>

somebody have a solution?
thanks for help

0 Karma

woodcock
Esteemed Legend

That is not a dashboard, that is a panel. If the dashboard that is hosting that panel does not contain a timepicker that sets time_token as well as other "stuff" that set the srcip, dstip, user, app, vdom, device, srcintf and dstintf tokens, then your panel('s search) will not run.

0 Karma

sathwikr076
Communicator

we have the same problem. we have time_token set for timepicker, can you please let me know how to make that work.
Thanks.

0 Karma

woodcock
Esteemed Legend

The easiest way is to view the dashboard, click Edit, then click the magnifying glass icon whose tooltip says, Edit search, then on the Time Range control, then click Use Time Picker and select Shared Timepicker (time_token), then click the green Apply button, then click the green Save button.

0 Karma

adonio
SplunkTrust
SplunkTrust

check permissions on the cloned dashboard?

0 Karma

skyluke70
New Member

hi
how i can control permission?

0 Karma

adonio
SplunkTrust
SplunkTrust

click on dashboards on nav bar -> find the cloned dashboard -> click edit -> permissions -> if its private, change to app context.
permissions is a wild guess that works more than 50% of the times in my little experience

0 Karma

skyluke70
New Member

do not work the permission it's ok but when i edit dashboard and want add clone panel i have always the same result waiting for input.

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!