Dashboards & Visualizations

change event handler not working for token from within the same input

meleperuma
Explorer

I'm having certain panel in my dashboard using | pivot command and others using | datamodel command (coz there are certain things you cant do with pivot).

I want to allow the user to select the granularity of the time charts in the dashboard when they select a longer time range.

So, in the change event handler, I'm trying to convert the span value compatible with the period argument in pivot.

 

<input type="dropdown" token="span" searchWhenChanged="true">
<label>Granularity</label>
<choice value="">Default</choice>
<choice value="span=1m">1 min</choice>
<choice value="span=15m">15 min</choice>
<choice value="span=30m">30 min</choice>
<choice value="span=1h">1 hour</choice>
<choice value="span=1d">1 day</choice>
<default></default>
<change>
<eval token="PivotPeriodAutoSolo">case("$span$"="span=1m", "1m", "$span$"="span=15m", "15m", "$span$"="span=30m", 30m, "$span$"="span=1h", 1h, "$span$"="span=1d", 1d, 1=1, "auto")</eval>
</change>
</input>

 

 

But for some reason this change does not get applied.

Labels (2)
0 Karma
1 Solution

ragedsparrow
Contributor

That makes sense.  When you have a change tag, you have to use the condition tag as well to set the token. This could also take the place of your case statement.  Here is what I used as a rudimentary test.  Hopefully it gets you down the road for your solution:

 

    <input type="dropdown" token="span" searchWhenChanged="true">
      <label>Granularity</label>
      <choice value="">Default</choice>
      <choice value="span=1m">1 min</choice>
      <choice value="span=15m">15 min</choice>
      <choice value="span=30m">30 min</choice>
      <choice value="span=1h">1 hour</choice>
      <choice value="span=1d">1 day</choice>
      <change>
        <condition value="span=1m">
          <set token="PivotPeriodAutoSolo">1m</set>
        </condition>
        <condition value="span=15m">
          <set token="PivotPeriodAutoSolo">15m</set>
        </condition>
        <condition value="span=30m">
          <set token="PivotPeriodAutoSolo">30m</set>
        </condition>
        <condition value="span=1h">
          <set token="PivotPeriodAutoSolo">1h</set>
        </condition>
        <condition value="span=1d">
          <set token="PivotPeriodAutoSolo">1d</set>
        </condition>
        <condition value="">
          <set token="PivotPeriodAutoSolo">auto</set>
        </condition>
      </change>
    </input>

View solution in original post

meleperuma
Explorer

Below is one of the panel searches

| pivot `uA_DM_Process_ProcessDetail` Process_ProcessDetail 
  sum(ProcCPUPercent) as ProcCPUPercent 
  splitrow AppName as "App name" 
  splitrow time as _time period $PivotPeriodAutoSolo$ 
  splitrow host as host 
  filter AppName isNot "Microsoft Windows OS" 
  $SearchFilter$  
| timechart $span$ perc90(ProcCPUPercent) as "avg(ProcCPUPercent)" by "App name" 
| join type=outer _time 
    [| pivot `uA_DM_System_SystemPerformanceSummary` System_SystemPerformanceSummary
        max(CPURelativeFrequencyPercent) as "Max.CPURelativeFrequencyPercent"
        splitrow _time
        period $PivotPeriodAutoSolo$
        $SearchFilter$ ]

As you can see here, since I have use different formats for span in pivot and timechart commands, I have to do the conversion. And the reason I'm keeping the default value "" (blank) is not to cause any syntax errors in case I use "span" as a timachart option.

0 Karma

ragedsparrow
Contributor

That makes sense.  When you have a change tag, you have to use the condition tag as well to set the token. This could also take the place of your case statement.  Here is what I used as a rudimentary test.  Hopefully it gets you down the road for your solution:

 

    <input type="dropdown" token="span" searchWhenChanged="true">
      <label>Granularity</label>
      <choice value="">Default</choice>
      <choice value="span=1m">1 min</choice>
      <choice value="span=15m">15 min</choice>
      <choice value="span=30m">30 min</choice>
      <choice value="span=1h">1 hour</choice>
      <choice value="span=1d">1 day</choice>
      <change>
        <condition value="span=1m">
          <set token="PivotPeriodAutoSolo">1m</set>
        </condition>
        <condition value="span=15m">
          <set token="PivotPeriodAutoSolo">15m</set>
        </condition>
        <condition value="span=30m">
          <set token="PivotPeriodAutoSolo">30m</set>
        </condition>
        <condition value="span=1h">
          <set token="PivotPeriodAutoSolo">1h</set>
        </condition>
        <condition value="span=1d">
          <set token="PivotPeriodAutoSolo">1d</set>
        </condition>
        <condition value="">
          <set token="PivotPeriodAutoSolo">auto</set>
        </condition>
      </change>
    </input>

meleperuma
Explorer

Thanks @ragedsparrow. it worked like a charm 🙂

ragedsparrow
Contributor

I'm just curious on why you need the case statement?  You are basically doing the case in the drop down, so I would set the default option to "auto" (which is your default value in your case), and use the dropdown token.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...