Dashboards & Visualizations

Why does numeric input value keep dashboard search "Waiting for input"?

yuanliu
SplunkTrust
SplunkTrust

When I set a select list for a numeric field, panel search keeps "Waiting for input". Sample input:

      <input type="dropdown" token="score_tok" searchWhenChanged="true">
        <label>Severity cutoff</label>
        <choice value="10.0">Top</choice>
        <choice value="9.5">9.5</choice>
        <choice value="0.0">All</choice>
        <default>10.0</default>
      </input>

Sample search:

index=hubble score >= $score_tok$

I have used input tokens from dynamic search and from static values without problems. The only difference I can see is perhaps the use of static numeric values.

I can definitely run searches like index=hubble score>=10.0, even inside the panel search. I can also display values of $score_tok$ in the panel's title and so on. But score >= $score_tok$ inside the panel search always stalls. Suspecting that the decimal point may be causing problem, I even tried | where scroe >= tonumber($score_tok$), quoting the token, without decimal point, etc., to no avail. I even tried to throw the token value without comparison operator (i.e., just index=hubble $score_tok$), as long as the token returns only a numeric value, the search stalls.

The only alternative that works around the problem is to force the comparison search term into the input values, e.g.,

      <input type="dropdown" token="score_tok" searchWhenChanged="true">
        <label>Severity cutoff</label>
        <choice value="10">Top</choice>
        <choice value="9.5">≥ 9.5</choice>
        <choice value="0.0">All</choice>
        <default>10</default>
        <prefix>score >= </prefix>
      </input>

And change search to

index=hubble $score_tok$

Whereas this solves the problem, I am curious why the numeric value wouldn't be recognized as "input" even it can be displayed in title.

0 Karma
1 Solution

yuanliu
SplunkTrust
SplunkTrust

Very much like @luna23 discovered in this thread, the problem magically disappeared after my "workaround" that forced an initial value for $score_tok$ in the Splunk system. Now I can revert the to original algorithm and have selected value propagating into panel searches (and not just titles). Maybe I should have set <initialValue>10.0</initialValue> instead of just <default>10.0</default>. There is no way for me to know now that an initial value is set. I'd consider this a usability bug.

View solution in original post

yuanliu
SplunkTrust
SplunkTrust

Very much like @luna23 discovered in this thread, the problem magically disappeared after my "workaround" that forced an initial value for $score_tok$ in the Splunk system. Now I can revert the to original algorithm and have selected value propagating into panel searches (and not just titles). Maybe I should have set <initialValue>10.0</initialValue> instead of just <default>10.0</default>. There is no way for me to know now that an initial value is set. I'd consider this a usability bug.

lfedak_splunk
Splunk Employee
Splunk Employee

Hey @yuanliu, Nice job working out a workaround solution. Here's a link to report a bug if you would like to file a case about this workflow: http://www.splunk.com/r/bugs

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...