Dashboards & Visualizations

cascade token is not resolving in query with multiple dropdown

nagarajsf
Explorer

I have a dashboard with a dropdown that contains a list of values. The value of the choices must match to another dropdown list and get the respective results in dashboard but we tokens are not resolving in query when I checked in dashboard.

<form>
      <label>Da1</label>
      <fieldset submitButton="false" autoRun="true">
          <input type="time" token="field1">
            <label>Select Window</label>
            <default>
              <earliest>-24h@h</earliest>
              <latest>now</latest>
            </default>
          </input>
          <input type="dropdown" token="tokPlatform" searchWhenChanged="true">
            <label>Select Platform</label>
            <default>On-prem</default>
            <choice value="APPLICATION=Hadoop OR APPLICATION=*Unix*">On-prem</choice>
            <choice value="MANAGER_NAME=*.corporate.com OR NETWORKELEMENTCODE= PRD.* ">Cloud-AWS</choice>
            <choice value="Null">Cloud-Azure</choice>
          </input>
          <input type="dropdown" token="tokEnvironment" searchWhenChanged="true">
            <label>Select Environment</label>
            <default>Prod</default>
            <choice value="$tokPlatform$ MANAGER_NAME=prdehdp* OR MANAGER_NAME=prdplhdpx*  OR MANAGER_NAME=prdasdp">Prod</choice>
            <choice value="$tokPlatform$ APPLICATION=Hadoop AMONAME=dev*">Dev</choice>
            <choice value="$tokPlatform$ APPLICATION=Hadoop AMONAME=QAT*">QAT</choice>
          </input>
    </fieldset>
        <panel id="ticketStatusPanel">
          <title>HDP INFRA ALERTS CHART</title>
          <chart>
            <title>ALERTS SEVERITY</title>
            <search>
              <query>index=alarms sourcetype=ommc_alarms $tokEnvironment$ |  eval compound_exp=AMONAME + "#" + NETWORKELEMENTCODE|timechart span=5m count(compound_exp) BY SEVERITY </query>
              <earliest>$field1.earliest$</earliest>
              <latest>$field1.latest$</latest>
              <refresh>5m</refresh>
              <refreshType>delay</refreshType>
            </search>
            <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
            <option name="charting.axisLabelsY.majorUnit">1</option>
            <option name="charting.axisTitleY.text">Count</option>
            <option name="charting.axisY.abbreviation">none</option>
            <option name="charting.axisY.minimumNumber">0</option>
            <option name="charting.axisY.scale">linear</option>
            <option name="charting.chart">column</option>
            <option name="charting.chart.showDataLabels">none</option>
            <option name="charting.chart.stackMode">default</option>
            <option name="charting.drilldown">all</option>
            <option name="charting.fieldColors">{"CRITICAL":0xFF0000,"MINOR":0xFF8000, "MAJOR":0xFF8000}</option>
            <option name="charting.layout.splitSeries">0</option>
            <option name="charting.legend.labelStyle.overflowMode">ellipsisEnd</option>
            <drilldown>
              <set token="clicked_earliest">$earliest$</set>
              <set token="clicked_latest">$latest$</set>
              <set token="clicked_group">$click.name2$</set>
            </drilldown>
          </chart>
        </panel>
        <panel id="countTicketPanel">
          <title>TICKET STATUS CHART</title>
          <chart>
            <title>Ticket status</title>
            <search>
              <query>index=alarms sourcetype=ommc_alarms $tokEnvironment$ |  eval compound_exp=AMONAME + "#" + NETWORKELEMENTCODE |timechart span=4m count(compound_exp) BY TICKET_STATUS</query>
              <earliest>-24h@h</earliest>
              <latest>now</latest>
            </search>
            <option name="charting.axisLabelsY.majorUnit">1</option>
            <option name="charting.axisTitleX.visibility">visible</option>
            <option name="charting.axisTitleY.text">Count</option>
            <option name="charting.axisTitleY.visibility">visible</option>
            <option name="charting.axisTitleY2.visibility">visible</option>
            <option name="charting.axisY.abbreviation">none</option>
            <option name="charting.axisY.minimumNumber">0</option>
            <option name="charting.axisY.scale">linear</option>
            <option name="charting.chart">column</option>
            <option name="charting.chart.showDataLabels">none</option>
            <option name="trellis.size">large</option>
            <drilldown>
              <set token="clicked_earliest">$earliest$</set>
              <set token="clicked_latest">$latest$</set>
              <set token="clicked_group">$click.name2$</set>
            </drilldown>
          </chart>
        </panel>
      </row>
      <row id="row2">

        <panel id="t2">
          <title>Important alerts by severity ($resultcount$)</title>
          <table id="table2">
            <search>
              <query>index=alarms sourcetype=ommc_alarms $tokEnvironment$ AND TICKET_STATUS!="Closed" AND  TICKET_STATUS!= "Resolved" |  eval compound_exp=AMONAME + "#" + NETWORKELEMENTCODE | rename TTID as Ticket | table Ticket,MANAGER_NAME,SEVERITY,DESCRIPTION,CREATED_DATE,TICKET_STATUS,UPDATE_DATE  | dedup Ticket | sort - SEVERITY desc</query>
              <earliest>$earliest$</earliest>
              <latest>$latest$</latest>
              <done>
                <eval token="resultcount">$job.resultCount$</eval>
              </done>
            </search>
            <option name="count">10</option>
            <option name="dataOverlayMode">none</option>
            <option name="drilldown">cell</option>
            <option name="refresh.display">progressbar</option>
            <option name="rowNumbers">false</option>
            <option name="wrap">true</option>
            <format type="color" field="SEVERITY">
              <colorPalette type="map">{"CRITICAL":#DC4E41,"MINOR":#F8BE34,"MAJOR":0xFF8000}</colorPalette>
            </format>
          </table>
        </panel>
        <panel id="t1">
          <title>OPEN TICKET STATUS ($resultcount1$)</title>
          <table id="table1">
            <search>
              <done>
                <eval token="resultcount1">$job.resultCount$</eval>
              </done>
              <query>index=alarms sourcetype=ommc_alarms $tokEnvironment$ AND TICKET_STATUS!="Closed" AND  TICKET_STATUS!= "Resolved"  | rename TTID as Ticket | eval ot = strptime(CREATED_DATE, "%Y-%m-%d %H:%M:%S")   
              | eval ud = strptime(UPDATE_DATE, "%Y-%m-%d %H:%M:%S") 
              | eval nowstring=strftime(now(), "%Y-%m-%d %H:%M:%S") 
              | eval open_status(hr)=tostring((now() - ot), "duration" )  | eval lastactionON(hr)=tostring((now() - ud), "duration" )  
              | table Ticket,TICKET_STATUS,UPDATE_DATE, open_status(hr), lastactionON(hr) | where  TICKET_STATUS!= "Resolved" | dedup Ticket</query>
              <earliest>-24h@h</earliest>
              <latest>now</latest>
            </search>
            <option name="count">10</option>
            <option name="dataOverlayMode">none</option>
            <option name="drilldown">cell</option>
            <option name="percentagesRow">false</option>
            <option name="refresh.display">progressbar</option>
            <option name="rowNumbers">false</option>
            <option name="totalsRow">false</option>
            <option name="wrap">true</option>
            <format type="color" field="TICKET_STATUS">
              <colorPalette type="map">{"Assigned":#DC4E41,"Working":#F8BE34 }</colorPalette>
            </format>
          </table>
        </panel>
      </row>
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...