Dashboards & Visualizations

Why is the text input not filtering results correctly in the dashboard?

gbwilson
Path Finder

So I have a dashboard with 3 different inputs. I noticed something really weird with my text input. If I enter the number 22 into my text input search, results on my dashboard stats table include 21, 22, 24, 25, 27, 28, 29, 33, etc.

Why is my text input showing me results that don't match the text input exactly?

alt text

Below is my query for the stats table:

(index=cms_vm) $arrayfield$ $lun$ $datacenter$
| dedup VM
| eval DatastoreName=replace(DatastoreName,".+_(\d+)$","\1") 
| eval StorageArray=replace(StorageArray,"^[^_]*_[^_]*\K.*$","")
| eval VM=upper(VM)
| eval StorageArray=upper(StorageArray)
| join type=outer VM [search index="cms_app_server" | fields VM Application]
| table VM OperatingSystem_Code Datacenter StorageArray DatastoreName Application
| rename OperatingSystem_Code AS "Operating System", StorageArray AS "Storage Array", DatastoreName AS "LUN"

Any help would be appreciated as I can't seem to pinpoint why this is occurring.

0 Karma
1 Solution

FrankVl
Ultra Champion

It will match any event with the string 22 in the raw event. I'm guessing it matches a 22 somewhere else then where you want to match it (the lun number), like in a timestamp or so? So you may need to create a more advanced filtering rather than just plain text search strings.
Isn't that 'lun' info available in a specific field?

Otherwise post some sample data so we can help improve your query.

View solution in original post

0 Karma

Flex223
New Member

I have been having the same problem when building one of my projects, but then I was fixed, the more problems I got with the design, but I found a good option for me, just bought several mockups from https://webdesignblog.info/html-css-templates/bootstrap-4-admin-dashboards/ it was very nice at the result.

0 Karma

FrankVl
Ultra Champion

It will match any event with the string 22 in the raw event. I'm guessing it matches a 22 somewhere else then where you want to match it (the lun number), like in a timestamp or so? So you may need to create a more advanced filtering rather than just plain text search strings.
Isn't that 'lun' info available in a specific field?

Otherwise post some sample data so we can help improve your query.

View solution in original post

0 Karma

gbwilson
Path Finder

@FrankVI how would you recommend doing more advanced filtering? I also tried creating a multiselect the dynamically updates based on the first two inputs. It still will display results that should not be appearing.

0 Karma

FrankVl
Ultra Champion

It would help if you could share some info on what the data looks like. But from what the rest of your search looks like, I'm guessing the DatastoreName field actually contains the LUN number that you want to filter for?

So you could try something as simple as putting the following into the token prefix field:
DatastoreName = *_

Such that the search will be:

 (index=cms_vm) $arrayfield$ DatastoreName = *_$lun$ $datacenter$ | ...

PS: you might want to do similar things for the other tokens as well, since it looks like also datacenter and array are actually related to fields?

0 Karma

gbwilson
Path Finder

Adding the token prefix DatastoreName=*_ fixed the issue. Thank you for your help. I will definitely do the same for my other tokens since they are related to fields.

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!