Dashboards & Visualizations

Why does numeric input value keep dashboard search "Waiting for input"?

yuanliu
SplunkTrust
SplunkTrust

When I set a select list for a numeric field, panel search keeps "Waiting for input". Sample input:

      <input type="dropdown" token="score_tok" searchWhenChanged="true">
        <label>Severity cutoff</label>
        <choice value="10.0">Top</choice>
        <choice value="9.5">9.5</choice>
        <choice value="0.0">All</choice>
        <default>10.0</default>
      </input>

Sample search:

index=hubble score >= $score_tok$

I have used input tokens from dynamic search and from static values without problems. The only difference I can see is perhaps the use of static numeric values.

I can definitely run searches like index=hubble score>=10.0, even inside the panel search. I can also display values of $score_tok$ in the panel's title and so on. But score >= $score_tok$ inside the panel search always stalls. Suspecting that the decimal point may be causing problem, I even tried | where scroe >= tonumber($score_tok$), quoting the token, without decimal point, etc., to no avail. I even tried to throw the token value without comparison operator (i.e., just index=hubble $score_tok$), as long as the token returns only a numeric value, the search stalls.

The only alternative that works around the problem is to force the comparison search term into the input values, e.g.,

      <input type="dropdown" token="score_tok" searchWhenChanged="true">
        <label>Severity cutoff</label>
        <choice value="10">Top</choice>
        <choice value="9.5">≥ 9.5</choice>
        <choice value="0.0">All</choice>
        <default>10</default>
        <prefix>score >= </prefix>
      </input>

And change search to

index=hubble $score_tok$

Whereas this solves the problem, I am curious why the numeric value wouldn't be recognized as "input" even it can be displayed in title.

0 Karma
1 Solution

yuanliu
SplunkTrust
SplunkTrust

Very much like @luna23 discovered in this thread, the problem magically disappeared after my "workaround" that forced an initial value for $score_tok$ in the Splunk system. Now I can revert the to original algorithm and have selected value propagating into panel searches (and not just titles). Maybe I should have set <initialValue>10.0</initialValue> instead of just <default>10.0</default>. There is no way for me to know now that an initial value is set. I'd consider this a usability bug.

View solution in original post

yuanliu
SplunkTrust
SplunkTrust

Very much like @luna23 discovered in this thread, the problem magically disappeared after my "workaround" that forced an initial value for $score_tok$ in the Splunk system. Now I can revert the to original algorithm and have selected value propagating into panel searches (and not just titles). Maybe I should have set <initialValue>10.0</initialValue> instead of just <default>10.0</default>. There is no way for me to know now that an initial value is set. I'd consider this a usability bug.

lfedak_splunk
Splunk Employee
Splunk Employee

Hey @yuanliu, Nice job working out a workaround solution. Here's a link to report a bug if you would like to file a case about this workflow: http://www.splunk.com/r/bugs

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...