Dashboards & Visualizations

change event handler not working for token from within the same input

meleperuma
Explorer

I'm having certain panel in my dashboard using | pivot command and others using | datamodel command (coz there are certain things you cant do with pivot).

I want to allow the user to select the granularity of the time charts in the dashboard when they select a longer time range.

So, in the change event handler, I'm trying to convert the span value compatible with the period argument in pivot.

 

<input type="dropdown" token="span" searchWhenChanged="true">
<label>Granularity</label>
<choice value="">Default</choice>
<choice value="span=1m">1 min</choice>
<choice value="span=15m">15 min</choice>
<choice value="span=30m">30 min</choice>
<choice value="span=1h">1 hour</choice>
<choice value="span=1d">1 day</choice>
<default></default>
<change>
<eval token="PivotPeriodAutoSolo">case("$span$"="span=1m", "1m", "$span$"="span=15m", "15m", "$span$"="span=30m", 30m, "$span$"="span=1h", 1h, "$span$"="span=1d", 1d, 1=1, "auto")</eval>
</change>
</input>

 

 

But for some reason this change does not get applied.

Labels (2)
0 Karma
1 Solution

ragedsparrow
SplunkTrust
SplunkTrust

That makes sense.  When you have a change tag, you have to use the condition tag as well to set the token. This could also take the place of your case statement.  Here is what I used as a rudimentary test.  Hopefully it gets you down the road for your solution:

 

    <input type="dropdown" token="span" searchWhenChanged="true">
      <label>Granularity</label>
      <choice value="">Default</choice>
      <choice value="span=1m">1 min</choice>
      <choice value="span=15m">15 min</choice>
      <choice value="span=30m">30 min</choice>
      <choice value="span=1h">1 hour</choice>
      <choice value="span=1d">1 day</choice>
      <change>
        <condition value="span=1m">
          <set token="PivotPeriodAutoSolo">1m</set>
        </condition>
        <condition value="span=15m">
          <set token="PivotPeriodAutoSolo">15m</set>
        </condition>
        <condition value="span=30m">
          <set token="PivotPeriodAutoSolo">30m</set>
        </condition>
        <condition value="span=1h">
          <set token="PivotPeriodAutoSolo">1h</set>
        </condition>
        <condition value="span=1d">
          <set token="PivotPeriodAutoSolo">1d</set>
        </condition>
        <condition value="">
          <set token="PivotPeriodAutoSolo">auto</set>
        </condition>
      </change>
    </input>

View solution in original post

meleperuma
Explorer

Below is one of the panel searches

| pivot `uA_DM_Process_ProcessDetail` Process_ProcessDetail 
  sum(ProcCPUPercent) as ProcCPUPercent 
  splitrow AppName as "App name" 
  splitrow time as _time period $PivotPeriodAutoSolo$ 
  splitrow host as host 
  filter AppName isNot "Microsoft Windows OS" 
  $SearchFilter$  
| timechart $span$ perc90(ProcCPUPercent) as "avg(ProcCPUPercent)" by "App name" 
| join type=outer _time 
    [| pivot `uA_DM_System_SystemPerformanceSummary` System_SystemPerformanceSummary
        max(CPURelativeFrequencyPercent) as "Max.CPURelativeFrequencyPercent"
        splitrow _time
        period $PivotPeriodAutoSolo$
        $SearchFilter$ ]

As you can see here, since I have use different formats for span in pivot and timechart commands, I have to do the conversion. And the reason I'm keeping the default value "" (blank) is not to cause any syntax errors in case I use "span" as a timachart option.

0 Karma

ragedsparrow
SplunkTrust
SplunkTrust

That makes sense.  When you have a change tag, you have to use the condition tag as well to set the token. This could also take the place of your case statement.  Here is what I used as a rudimentary test.  Hopefully it gets you down the road for your solution:

 

    <input type="dropdown" token="span" searchWhenChanged="true">
      <label>Granularity</label>
      <choice value="">Default</choice>
      <choice value="span=1m">1 min</choice>
      <choice value="span=15m">15 min</choice>
      <choice value="span=30m">30 min</choice>
      <choice value="span=1h">1 hour</choice>
      <choice value="span=1d">1 day</choice>
      <change>
        <condition value="span=1m">
          <set token="PivotPeriodAutoSolo">1m</set>
        </condition>
        <condition value="span=15m">
          <set token="PivotPeriodAutoSolo">15m</set>
        </condition>
        <condition value="span=30m">
          <set token="PivotPeriodAutoSolo">30m</set>
        </condition>
        <condition value="span=1h">
          <set token="PivotPeriodAutoSolo">1h</set>
        </condition>
        <condition value="span=1d">
          <set token="PivotPeriodAutoSolo">1d</set>
        </condition>
        <condition value="">
          <set token="PivotPeriodAutoSolo">auto</set>
        </condition>
      </change>
    </input>

meleperuma
Explorer

Thanks @ragedsparrow. it worked like a charm 🙂

ragedsparrow
SplunkTrust
SplunkTrust

I'm just curious on why you need the case statement?  You are basically doing the case in the drop down, so I would set the default option to "auto" (which is your default value in your case), and use the dropdown token.

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...