Dashboards & Visualizations

change event handler not working for token from within the same input

meleperuma
Explorer

I'm having certain panel in my dashboard using | pivot command and others using | datamodel command (coz there are certain things you cant do with pivot).

I want to allow the user to select the granularity of the time charts in the dashboard when they select a longer time range.

So, in the change event handler, I'm trying to convert the span value compatible with the period argument in pivot.

 

<input type="dropdown" token="span" searchWhenChanged="true">
<label>Granularity</label>
<choice value="">Default</choice>
<choice value="span=1m">1 min</choice>
<choice value="span=15m">15 min</choice>
<choice value="span=30m">30 min</choice>
<choice value="span=1h">1 hour</choice>
<choice value="span=1d">1 day</choice>
<default></default>
<change>
<eval token="PivotPeriodAutoSolo">case("$span$"="span=1m", "1m", "$span$"="span=15m", "15m", "$span$"="span=30m", 30m, "$span$"="span=1h", 1h, "$span$"="span=1d", 1d, 1=1, "auto")</eval>
</change>
</input>

 

 

But for some reason this change does not get applied.

Labels (2)
0 Karma
1 Solution

ragedsparrow
SplunkTrust
SplunkTrust

That makes sense.  When you have a change tag, you have to use the condition tag as well to set the token. This could also take the place of your case statement.  Here is what I used as a rudimentary test.  Hopefully it gets you down the road for your solution:

 

    <input type="dropdown" token="span" searchWhenChanged="true">
      <label>Granularity</label>
      <choice value="">Default</choice>
      <choice value="span=1m">1 min</choice>
      <choice value="span=15m">15 min</choice>
      <choice value="span=30m">30 min</choice>
      <choice value="span=1h">1 hour</choice>
      <choice value="span=1d">1 day</choice>
      <change>
        <condition value="span=1m">
          <set token="PivotPeriodAutoSolo">1m</set>
        </condition>
        <condition value="span=15m">
          <set token="PivotPeriodAutoSolo">15m</set>
        </condition>
        <condition value="span=30m">
          <set token="PivotPeriodAutoSolo">30m</set>
        </condition>
        <condition value="span=1h">
          <set token="PivotPeriodAutoSolo">1h</set>
        </condition>
        <condition value="span=1d">
          <set token="PivotPeriodAutoSolo">1d</set>
        </condition>
        <condition value="">
          <set token="PivotPeriodAutoSolo">auto</set>
        </condition>
      </change>
    </input>

View solution in original post

meleperuma
Explorer

Below is one of the panel searches

| pivot `uA_DM_Process_ProcessDetail` Process_ProcessDetail 
  sum(ProcCPUPercent) as ProcCPUPercent 
  splitrow AppName as "App name" 
  splitrow time as _time period $PivotPeriodAutoSolo$ 
  splitrow host as host 
  filter AppName isNot "Microsoft Windows OS" 
  $SearchFilter$  
| timechart $span$ perc90(ProcCPUPercent) as "avg(ProcCPUPercent)" by "App name" 
| join type=outer _time 
    [| pivot `uA_DM_System_SystemPerformanceSummary` System_SystemPerformanceSummary
        max(CPURelativeFrequencyPercent) as "Max.CPURelativeFrequencyPercent"
        splitrow _time
        period $PivotPeriodAutoSolo$
        $SearchFilter$ ]

As you can see here, since I have use different formats for span in pivot and timechart commands, I have to do the conversion. And the reason I'm keeping the default value "" (blank) is not to cause any syntax errors in case I use "span" as a timachart option.

0 Karma

ragedsparrow
SplunkTrust
SplunkTrust

That makes sense.  When you have a change tag, you have to use the condition tag as well to set the token. This could also take the place of your case statement.  Here is what I used as a rudimentary test.  Hopefully it gets you down the road for your solution:

 

    <input type="dropdown" token="span" searchWhenChanged="true">
      <label>Granularity</label>
      <choice value="">Default</choice>
      <choice value="span=1m">1 min</choice>
      <choice value="span=15m">15 min</choice>
      <choice value="span=30m">30 min</choice>
      <choice value="span=1h">1 hour</choice>
      <choice value="span=1d">1 day</choice>
      <change>
        <condition value="span=1m">
          <set token="PivotPeriodAutoSolo">1m</set>
        </condition>
        <condition value="span=15m">
          <set token="PivotPeriodAutoSolo">15m</set>
        </condition>
        <condition value="span=30m">
          <set token="PivotPeriodAutoSolo">30m</set>
        </condition>
        <condition value="span=1h">
          <set token="PivotPeriodAutoSolo">1h</set>
        </condition>
        <condition value="span=1d">
          <set token="PivotPeriodAutoSolo">1d</set>
        </condition>
        <condition value="">
          <set token="PivotPeriodAutoSolo">auto</set>
        </condition>
      </change>
    </input>

meleperuma
Explorer

Thanks @ragedsparrow. it worked like a charm 🙂

ragedsparrow
SplunkTrust
SplunkTrust

I'm just curious on why you need the case statement?  You are basically doing the case in the drop down, so I would set the default option to "auto" (which is your default value in your case), and use the dropdown token.

0 Karma
Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...