Dashboards & Visualizations

change event handler not working for token from within the same input

meleperuma
Explorer

I'm having certain panel in my dashboard using | pivot command and others using | datamodel command (coz there are certain things you cant do with pivot).

I want to allow the user to select the granularity of the time charts in the dashboard when they select a longer time range.

So, in the change event handler, I'm trying to convert the span value compatible with the period argument in pivot.

 

<input type="dropdown" token="span" searchWhenChanged="true">
<label>Granularity</label>
<choice value="">Default</choice>
<choice value="span=1m">1 min</choice>
<choice value="span=15m">15 min</choice>
<choice value="span=30m">30 min</choice>
<choice value="span=1h">1 hour</choice>
<choice value="span=1d">1 day</choice>
<default></default>
<change>
<eval token="PivotPeriodAutoSolo">case("$span$"="span=1m", "1m", "$span$"="span=15m", "15m", "$span$"="span=30m", 30m, "$span$"="span=1h", 1h, "$span$"="span=1d", 1d, 1=1, "auto")</eval>
</change>
</input>

 

 

But for some reason this change does not get applied.

Labels (2)
0 Karma
1 Solution

ragedsparrow
Contributor

That makes sense.  When you have a change tag, you have to use the condition tag as well to set the token. This could also take the place of your case statement.  Here is what I used as a rudimentary test.  Hopefully it gets you down the road for your solution:

 

    <input type="dropdown" token="span" searchWhenChanged="true">
      <label>Granularity</label>
      <choice value="">Default</choice>
      <choice value="span=1m">1 min</choice>
      <choice value="span=15m">15 min</choice>
      <choice value="span=30m">30 min</choice>
      <choice value="span=1h">1 hour</choice>
      <choice value="span=1d">1 day</choice>
      <change>
        <condition value="span=1m">
          <set token="PivotPeriodAutoSolo">1m</set>
        </condition>
        <condition value="span=15m">
          <set token="PivotPeriodAutoSolo">15m</set>
        </condition>
        <condition value="span=30m">
          <set token="PivotPeriodAutoSolo">30m</set>
        </condition>
        <condition value="span=1h">
          <set token="PivotPeriodAutoSolo">1h</set>
        </condition>
        <condition value="span=1d">
          <set token="PivotPeriodAutoSolo">1d</set>
        </condition>
        <condition value="">
          <set token="PivotPeriodAutoSolo">auto</set>
        </condition>
      </change>
    </input>

View solution in original post

meleperuma
Explorer

Below is one of the panel searches

| pivot `uA_DM_Process_ProcessDetail` Process_ProcessDetail 
  sum(ProcCPUPercent) as ProcCPUPercent 
  splitrow AppName as "App name" 
  splitrow time as _time period $PivotPeriodAutoSolo$ 
  splitrow host as host 
  filter AppName isNot "Microsoft Windows OS" 
  $SearchFilter$  
| timechart $span$ perc90(ProcCPUPercent) as "avg(ProcCPUPercent)" by "App name" 
| join type=outer _time 
    [| pivot `uA_DM_System_SystemPerformanceSummary` System_SystemPerformanceSummary
        max(CPURelativeFrequencyPercent) as "Max.CPURelativeFrequencyPercent"
        splitrow _time
        period $PivotPeriodAutoSolo$
        $SearchFilter$ ]

As you can see here, since I have use different formats for span in pivot and timechart commands, I have to do the conversion. And the reason I'm keeping the default value "" (blank) is not to cause any syntax errors in case I use "span" as a timachart option.

0 Karma

ragedsparrow
Contributor

That makes sense.  When you have a change tag, you have to use the condition tag as well to set the token. This could also take the place of your case statement.  Here is what I used as a rudimentary test.  Hopefully it gets you down the road for your solution:

 

    <input type="dropdown" token="span" searchWhenChanged="true">
      <label>Granularity</label>
      <choice value="">Default</choice>
      <choice value="span=1m">1 min</choice>
      <choice value="span=15m">15 min</choice>
      <choice value="span=30m">30 min</choice>
      <choice value="span=1h">1 hour</choice>
      <choice value="span=1d">1 day</choice>
      <change>
        <condition value="span=1m">
          <set token="PivotPeriodAutoSolo">1m</set>
        </condition>
        <condition value="span=15m">
          <set token="PivotPeriodAutoSolo">15m</set>
        </condition>
        <condition value="span=30m">
          <set token="PivotPeriodAutoSolo">30m</set>
        </condition>
        <condition value="span=1h">
          <set token="PivotPeriodAutoSolo">1h</set>
        </condition>
        <condition value="span=1d">
          <set token="PivotPeriodAutoSolo">1d</set>
        </condition>
        <condition value="">
          <set token="PivotPeriodAutoSolo">auto</set>
        </condition>
      </change>
    </input>

meleperuma
Explorer

Thanks @ragedsparrow. it worked like a charm 🙂

ragedsparrow
Contributor

I'm just curious on why you need the case statement?  You are basically doing the case in the drop down, so I would set the default option to "auto" (which is your default value in your case), and use the dropdown token.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Event Series: The Agentic SOC: Trust Before Autonomy

AI is fundamentally changing security operations, but true progress requires more than just automation—it ...

Free Professional Services for .conf26 Attendees

This year at .conf26, we are doing something a little different. We are bringing the best minds from ...

Defend at Machine Speed: Your Guide to Security Sessions at .conf26

Splunk .conf26   With threats moving at machine speed and attack surfaces expanding across hybrid ...