Re: base search not working for panel table and dr...

deruvara · ‎12-07-2021

i am tryring to add a base search for a query and use the same for drop down and table. I see after adding search adding to base search , panel table shows no results.

my expectation is based on one of drop down selection i need my table to updated with that selected value.

please help

<form version="1.1">
<label>RH_Release_Information</label>
<description>FC-002 release info</description>
<search id="base_search">
<query>
index="wtqlty" source=pdf_07 sourcetype="release_pdf_results_json" | table pdf_name, pdf_state, main_line, req_report, patch_name, patch_tag, started_on, Stream_start, Handover, planned_stopped_on, fco_state, snapshot, stakeholders.project_leader.name, stakeholders.developer.name, air_issues{}.short_description , Quality, description | rename pdf_name AS PDF, pdf_state AS "PDFState", fco_state AS FCOState, main_line AS "Mainline", patch_name AS Project, patch_tag AS Tags, started_on AS "PDF start", planned_stopped_on AS "Planned Stop", stakeholders.project_leader.name AS PL, stakeholders.developer.name AS Developer, air_issues{}.short_description AS Description, description AS Questionnaire | search PDFState = "$form.PDFState$" PL ="$form.PL$" FCOState = "'$form.FCOState$"
</query>
<earliest>$time.earliest$</earliest>
<latest>$time.latest$</latest>
<sampleRatio>1</sampleRatio>
</search>
<fieldset submitButton="false" autoRun="true">
<input type="time" token="time" searchWhenChanged="true">
<label>Time</label>
<default>
<earliest>0</earliest>
<latest></latest>
</default>
</input>
<input type="dropdown" token="pdf_state_token">
<label>PDFState</label>
<choice value="*">All</choice>
<fieldForLabel>PDFState</fieldForLabel>
<fieldForValue>PDFState</fieldForValue>
<search base="base_search">
<query>| dedup PDFState | top PDFState</query>
</search>
<default>*</default>
</input>
<input type="dropdown" token="main_line">
<label>Assembly</label>
<choice value="*">All</choice>
<default>*</default>
<fieldForLabel>Mainline</fieldForLabel>
<fieldForValue>Mainline</fieldForValue>
<search base="base_search">
<query>| dedup Mainline | top Mainline</query>
</search>
</input>
<input type="dropdown" token="fco_state">
<label>FCOState</label>
<choice value="*">All</choice>
<default>*</default>
<fieldForLabel>FCOState</fieldForLabel>
<fieldForValue>FCOState</fieldForValue>
<search base="base_search">
<query>| dedup FCOState | top FCOState</query>
</search>
</input>
<input type="dropdown" token="snap_shot">
<label>ServicePacks</label>
<choice value="*">All</choice>
<default>*</default>
<fieldForLabel>snapshot</fieldForLabel>
<fieldForValue>snapshot</fieldForValue>
<search base="base_search">
<query>| dedup snapshot | stats by snapshot</query>
</search>
</input>
<input type="dropdown" token="PL">
<label>PL</label>
<choice value="*">All</choice>
<default>*</default>
<fieldForLabel>PL</fieldForLabel>
<fieldForValue>PL</fieldForValue>
<search base="base_search">
<query>dedup PL | stats by PL</query>
</search>
</input>
<input type="dropdown" token="developer">
<label>Developer</label>
<choice value="*">All</choice>
<default>*</default>
<fieldForLabel>Developer</fieldForLabel>
<fieldForValue>Developer</fieldForValue>
<search base="base_search">
<query>| dedup Developer | stats by Developer</query>
</search>
</input>
<input type="text" token="main_line" depends="$hidden$">
<default>*</default>
</input>
</fieldset>
<row>
<panel>
<title>RH_Release_Information</title>
<html>
<style>
#tableRowColorWithoutJS table tbody td div.multivalue-subcell[data-mv-index="1"]{
display: none;
}
</style>
</html>
<table>
<search base = "base_search">
<query> </query>
</search>
<option name="drilldown">cell</option>
<option name="refresh.display">progressbar</option>
<format type="color" field="FCOState">
<colorPalette type="expression">case (match(value,"DRAFT_DEV"), "#DC4E41",match(value,"ACCEPTED"),"#53A051"</colorPalette>
</format>
<format type="color" field="PDFState">
<colorPalette type="expression">case (match(value,"handover_to_integration"), "#DC4E41",match(value,"accepted"), "#53A051", like(value,"integrated"), "#FFFF00", true(),"#C3CBD4")</colorPalette>
</format>
<drilldown>
<condition field="PDF State">
<set token="form.pdf_state_token">$click.value2$</set>
</condition>
<condition field="PL">
<set token="form.PL">$click.value2$</set>
</condition>
<condition field="FCOState">
<set token="form.fco_name">$click.value2$</set>
</condition>
<condition field="Developer">
<set token="form.developer">$click.value2$</set>
</condition>
<condition field="Snapshot">
<set token="form.snap_shot">$click.value2$</set>
</condition>
<condition field="Mainline">
<set token="form.main_line">$click.value2$</set>
<link target="_blank">https://at.patchtooling.asml.com/pdf/RH/ML/patches/$click.value2$/</link>
</condition>
<condition field="Project">
<set token="form.patch_name">>$click.value2|n$</set>
<link target="_blank">https://stream-dashboard.asml.com/db/overall/$click.value2$/</link>
</condition>
<condition field="PDF">
<set token="form.pdf_name">$click.value$</set>
<link target="_blank">https://at.patchtooling.asml.com/pdf/RH/ML/patches/$row.Project|n$/</link>
</condition>
<condition field="req_report"></condition>
<condition field="PDF start"></condition>
<condition field="Stream_start"></condition>
<condition field="Handover"></condition>
<condition field="Planned Stop"></condition>
<condition field="Description"></condition>
<condition field="Quality"></condition>
<condition field="Questionnaire"></condition>
</drilldown>
</table>
<html depends="$form.show_clear_filter$">
<p>
<a href="#" data-set-token="form.main_line" data-value="*" data-unset-token="form.show_clear_filter" class="btn btn-secondary clear-filter">Clear Filter</a>
</p>
</html>
<html depends="$stayhidden$">
<style>
#id-of-panel div.multivalue-subcell {
text-decoration: line-through !important;
}
#id-of-panel div.multivalue-subcell[data-mv-index="0"] {
text-decoration: none !important;
}
</style>
</html>
</panel>
</row>
</form>

bowesmana · ‎12-07-2021

Base searches that are not transforming searches need to have a fields statement at the end, i.e. something like

| fields *

https://docs.splunk.com/Documentation/Splunk/8.2.3/Viz/Savedsearches#Post-process_searches_2

ITWhisperer · ‎12-07-2021

Move the filtering search from the base search to the table query and base it on the tokens set by the dropdowns, e.g. $PL$ rather than $form.PL$

deruvara · ‎12-08-2021

This worked.. thank you

base search not working for panel table and dropdown

drilldown

form

panel

table

token

Detecting Brute Force Account Takeover Fraud with Splunk

Buttercup Games: Further Dashboarding Techniques (Part 9)

Buttercup Games: Further Dashboarding Techniques (Part 8)

Are you a member of the Splunk Community?

base search not working for panel table and dropdown