Dashboards & Visualizations
Highlighted

Why does my dashboard crash when a search populates dropdown values?

Builder

Hello

I have a dashboard that exhibiting some strange behavior. I have the dashboard panel with the dropdowns that populate via searches, when I load the dashboard the page crashes

When I remove these dropdown fields, the dashboard has no problems.

This is the code for the 2 dropdowns but like I said the page crashes with them.

  <label>Proc</label>
    <search>
      <query>index=api host=*xxx* requestURI="/xxx/xxx/xx/*" ucm=true | rename clientIP AS clientip | lookup dnslookup clientip OUTPUT clienthost | transaction transactionId maxspan=10s | search "Inbound" OR "Outbound" | dedup proc | stats count by proc | rename proc as ProcName | table ProcName</query>
      <earliest>-4h@m</earliest>
      <latest>now</latest>
    </search>
    <fieldForLabel>ProcName</fieldForLabel>
    <fieldForValue>ProcName</fieldForValue>
  </input>
  <input type="dropdown" token="status_code_tok|s" searchWhenChanged="true">
    <label>Status Code</label>
    <search>
      <query>index=api host=*xxx* requestURI="/xxx/xxx/xxx/*" ucm=true | rename clientIP AS clientip | lookup dnslookup clientip OUTPUT clienthost | transaction transactionId maxspan=10s | search "Inbound" OR "Outbound" | stats count by statusCode | rename statusCode as StatusCode| table StatusCode</query>
      <earliest>-60m@m</earliest>
      <latest>now</latest>
    </search>
    <fieldForLabel>StatusCode</fieldForLabel>
    <fieldForValue>StatusCode</fieldForValue>
  </input>

Any ideas what the issue may be?

0 Karma
Highlighted

Re: Why does my dashboard crash when a search populates dropdown values?

Builder

your revision clipped the opening <input> tag

0 Karma
Highlighted

Re: Why does my dashboard crash when a search populates dropdown values?

Super Champion

those look like complex searches for inputs. transactions generally are not the best for processing. I'd try to find a way to rewrite the inputs more efficiently. possibly use a |streamstats time_window=10s transactionId

Highlighted

Re: Why does my dashboard crash when a search populates dropdown values?

Builder

So I broke the first dropwdown search down to this instead:
index=apigateway host=*xxx* requestURI="/xxx/xx/xx/*" ucm=true | search "Inbound" OR "Outbound" | dedup proc | stats count by proc | rename proc as ProcName | table ProcName

but still when I make the selection in the dropdown the page crashes

0 Karma
Highlighted

Re: Why does my dashboard crash when a search populates dropdown values?

Super Champion
index=apigateway host=*xxx* requestURI="/xxx/xx/xx/*" ucm=true ( "Inbound" OR "Outbound") | stats count by proc | rename proc as ProcName | fields ProcName

try something like that. you shouldn't need to |search right after the base and dedup shouldn't matter if you're just trying to get unique ProcNames for a dropdown.

0 Karma
Highlighted

Re: Why does my dashboard crash when a search populates dropdown values?

Builder

great ideas, optimization definitely improved performance

0 Karma
Highlighted

Re: Why does my dashboard crash when a search populates dropdown values?

Legend

See if this works. My guess is you have two long running queries. Change your dashboard to use post-processing searches to optimize it.

     <search id="baseQuery">
       <query>index=api host=*xxx* requestURI="/xxx/xxx/xx/*" ucm=true "Inbound" OR "Outbound" | rename clientIP AS clientip | lookup dnslookup clientip OUTPUT clienthost | stats count by proc statusCode</query>
    <search>

   <label>Proc</label>
     <search base="baseQuery">
       <query>| table proc | rename proc as ProcName | dedup ProcName</query>
       <earliest>-4h@m</earliest>
       <latest>now</latest>
     </search>
     <fieldForLabel>ProcName</fieldForLabel>
     <fieldForValue>ProcName</fieldForValue>
   </input>
   <input type="dropdown" token="status_code_tok|s" searchWhenChanged="true">
     <label>Status Code</label>
     <search base="baseQuery">
       <query>| dedup statusCode | rename statusCode as StatusCode| table StatusCode</query>
       <earliest>-60m@m</earliest>
       <latest>now</latest>
     </search>
     <fieldForLabel>StatusCode</fieldForLabel>
     <fieldForValue>StatusCode</fieldForValue>
   </input>

Here's documentation on post-process searches http://docs.splunk.com/Documentation/Splunk/6.5.1/Viz/Savedsearches#Post-process_searches

Highlighted

Re: Why does my dashboard crash when a search populates dropdown values?

Builder

I cloned the dashboard and tried this as well, same issue. As soon as I pick an option the page crashes

0 Karma
Highlighted

Re: Why does my dashboard crash when a search populates dropdown values?

Builder

I did use this in the dashobard, good thought

0 Karma
Highlighted

Re: Why does my dashboard crash when a search populates dropdown values?

Builder

I figured out why the dashboard is crashing in the search for the inputs the |s filter for the token was killing it. So i removed that then updated my dashboard searches.
So I just added prefixes and suffixes as needed for the searches and good to go.
Thanks for the ideas!

View solution in original post

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.