Why does my dashboard crash when a search populates dropdown values?

[tkwaller]

Hello

I have a dashboard that exhibiting some strange behavior. I have the dashboard panel with the dropdowns that populate via searches, when I load the dashboard the page crashes

When I remove these dropdown fields, the dashboard has no problems.

This is the code for the 2 dropdowns but like I said the page crashes with them.

  <label>Proc</label>
    <search>
      <query>index=api host=*xxx* requestURI="/xxx/xxx/xx/*" ucm=true | rename clientIP AS clientip | lookup dnslookup clientip OUTPUT clienthost | transaction transactionId maxspan=10s | search "Inbound" OR "Outbound" | dedup proc | stats count by proc | rename proc as ProcName | table ProcName</query>
      <earliest>-4h@m</earliest>
      <latest>now</latest>
    </search>
    <fieldForLabel>ProcName</fieldForLabel>
    <fieldForValue>ProcName</fieldForValue>
  </input>
  <input type="dropdown" token="status_code_tok|s" searchWhenChanged="true">
    <label>Status Code</label>
    <search>
      <query>index=api host=*xxx* requestURI="/xxx/xxx/xxx/*" ucm=true | rename clientIP AS clientip | lookup dnslookup clientip OUTPUT clienthost | transaction transactionId maxspan=10s | search "Inbound" OR "Outbound" | stats count by statusCode | rename statusCode as StatusCode| table StatusCode</query>
      <earliest>-60m@m</earliest>
      <latest>now</latest>
    </search>
    <fieldForLabel>StatusCode</fieldForLabel>
    <fieldForValue>StatusCode</fieldForValue>
  </input>

Any ideas what the issue may be?

[tkwaller · Accepted solution]

I figured out why the dashboard is crashing in the search for the inputs the |s filter for the token was killing it. So i removed that then updated my dashboard searches.
So I just added prefixes and suffixes as needed for the searches and good to go.
Thanks for the ideas!

[sundareshr]

See if this works. My guess is you have two long running queries. Change your dashboard to use post-processing searches to optimize it.

     <search id="baseQuery">
       <query>index=api host=*xxx* requestURI="/xxx/xxx/xx/*" ucm=true "Inbound" OR "Outbound" | rename clientIP AS clientip | lookup dnslookup clientip OUTPUT clienthost | stats count by proc statusCode</query>
    <search>

   <label>Proc</label>
     <search base="baseQuery">
       <query>| table proc | rename proc as ProcName | dedup ProcName</query>
       <earliest>-4h@m</earliest>
       <latest>now</latest>
     </search>
     <fieldForLabel>ProcName</fieldForLabel>
     <fieldForValue>ProcName</fieldForValue>
   </input>
   <input type="dropdown" token="status_code_tok|s" searchWhenChanged="true">
     <label>Status Code</label>
     <search base="baseQuery">
       <query>| dedup statusCode | rename statusCode as StatusCode| table StatusCode</query>
       <earliest>-60m@m</earliest>
       <latest>now</latest>
     </search>
     <fieldForLabel>StatusCode</fieldForLabel>
     <fieldForValue>StatusCode</fieldForValue>
   </input>

Here's documentation on post-process searches http://docs.splunk.com/Documentation/Splunk/6.5.1/Viz/Savedsearches#Post-process_searches

[tkwaller]

I cloned the dashboard and tried this as well, same issue. As soon as I pick an option the page crashes

[tkwaller]

I did use this in the dashobard, good thought

[cmerriman]

those look like complex searches for inputs. transactions generally are not the best for processing. I'd try to find a way to rewrite the inputs more efficiently. possibly use a |streamstats time_window=10s transactionId

[tkwaller]

So I broke the first dropwdown search down to this instead:
index=apigateway host=*xxx* requestURI="/xxx/xx/xx/*" ucm=true | search "Inbound" OR "Outbound" | dedup proc | stats count by proc | rename proc as ProcName | table ProcName

but still when I make the selection in the dropdown the page crashes

[cmerriman]

index=apigateway host=*xxx* requestURI="/xxx/xx/xx/*" ucm=true ( "Inbound" OR "Outbound") | stats count by proc | rename proc as ProcName | fields ProcName

try something like that. you shouldn't need to |search right after the base and dedup shouldn't matter if you're just trying to get unique ProcNames for a dropdown.

[tkwaller]

great ideas, optimization definitely improved performance

[tkwaller]

your revision clipped the opening <input> tag