Why is dashboard not populating all hosts when ALL selected in the host dropdown?

[aldrichb]

I am having an issue with a dashboard not populating all hosts when I select ALL in the host dropdown.

For reference, I have a token $env$ which populates inside the host before $host$ is set. The issue I am having is when I select the dropdown to display ALL hosts in the table below, it shows no results.

Here is where I believe it is failing.

<eval token="host">if($host$ == "All", "xxx$env$-$service$*", $host$)</eval>

When I select ALL from the Hosts drop down I want the graphs to display all hosts from the previously selected dropdowns env and service

Is this possible?

[aldrichb · Accepted solution]

Upon looking at documention I found a solution to this issue.

<eval token="host">if($host$ == "All", "xx".$env$."01xx-".$service$."*", $host$)</eval>

After modifying this line, when I select All I now see all hosts represented on the panels.

[niketn]

@aldrichb will you be able to share host dropdown code? Do you set the label as All or even the value is All? Most of the time for Dropdown label All the value is actually *. You can also print the $host$ token value in any of the panel to ensure the value is getting set as expected.

If you want your logic to be based on dropdown label All and not the dropdown value which may be different, you can try the following:

  <change>
        <set token="tokHost">$label$</set>
  </change>

The use token $tokHost$ in your dashboard instead of $host$.
PS: If the Label and Value for host for values other than All changes then above approach might not work, for which you may need to provide your host dropdown code and some dummy sample values/labels if it is created dynamically through SPL.

[aldrichb]

Here is the code up to the point where I believe it errors

 <input type="time" searchWhenChanged="true" token="global_time_tok">
      <label>Time Range</label>
      <default>
        <earliest>-1h</earliest>
        <latest>now</latest>
      </default>
    </input>
    <input type="dropdown">
      <label>Time Span</label>
      <choice value="auto">auto</choice>
      <choice value="5s">5s</choice>
      <choice value="10s">10s</choice>
      <choice value="30s">30s</choice>
      <choice value="1m">1m</choice>
      <choice value="5m">5m</choice>
      <choice value="10m">10m</choice>
      <choice value="30m">30m</choice>
      <choice value="1h">1h</choice>
      <default>auto</default>
      <change>
        <eval token="timechart_span">if($value$ == "auto", "", "span=".$value$)</eval>
        <eval token="mstats_span">"span=".$value$</eval>
      </change>
    </input>
    <input type="dropdown" token="env" searchWhenChanged="true">
      <label>Environment</label>
      <choice value="n">UAT</choice>
      <choice value="p">PRD</choice>
      <default>p</default>
    </input>
    <input type="dropdown" token="service">
      <label>Service</label>
      <choice value="ap">Application</choice>
      <choice value="hc">Hazelcast</choice>
      <choice value="db">Database</choice>
      <choice value="mw">Middleware</choice>
    </input>
    <input type="dropdown" token="host" searchWhenChanged="true">
      <label>Host</label>
      <default>All</default>
      <fieldForLabel>hostfield</fieldForLabel>
      <fieldForValue>host</fieldForValue>
      <search>
        <query>index="xxx-*-wineventlog" host=xx$env$01xx-$service$* | stats count by host</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
      <change>
        <eval token="host">if($host$ == "All", "xx$env$01xx-$service$*", $host$)</eval>
      </change>

Above the graphs I have a panel with text which host is selected. And below that are various infrastructure monitoring graphs for that host. When I select ALL from the host drop down, I want all hosts in that specific Environment and Service that I previously selected in the drop downs before it. Currently when I select all the panel with the hostname changes to xx$env$01xx-$service$*

[niketn]

@aldrichb Seems like the value of host will be All by default and this is your change event handler so you should try this "$value$":

   <change>
     <eval token="host">if("$value$" == "All", "xx$env$01xx-$service$*", $value$)</eval>
   </change>

Refer to Splunk Documentation for accessing default input tokens in the input's <change> event handler: https://docs.splunk.com/Documentation/Splunk/latest/Viz/tokens#Predefined_tokens_for_accessing_label...

[niketn]

@aldrichb were you able to try the above? Is your issue resolved?

[aldrichb]

Sorry for the late response, I just noticed your response. I added that to my Source and when I change to all I still have No Results Found in the panels where I would like to see all hosts stats. Ideally every host would be represented in the graphs.

[to4kawa]

yes, it is. you can do it.