Solved: dashboard submit button

nithys · ‎03-28-2025

Hi

I have a dasahboard below code currently it gets result whenever the env dropdown is selected either test or prod.My use case is once select env from drop down+select data entity+time ...then when i hit submit button.It should fetch resu;t based on all these selection done

<form version="1.1" theme="dark">
  <label>Metrics222</label>
  <fieldset>
    <input type="dropdown" token="indexToken1" searchWhenChanged="false">
      <label>Environment</label>
      <choice value="prod-,prod,*">PROD</choice>
      <choice value="np-,test,*">TEST</choice>
      <change>
        <eval token="stageToken">mvindex(split($value$,","),1)</eval>
        <eval token="indexToken">mvindex(split($value$,","),0)</eval>
     
      </change>
    
    </input>
    <input type="dropdown" token="entityToken" searchWhenChanged="false">
      <label>Data Entity</label>
      <choice value="*">ALL</choice>
    </input>
    <input type="time" token="timeToken" searchWhenChanged="false">
      <label>Time</label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <html id="APIStats">
          <style>
          #user{
          text-align:center;
          color:#BFFF00;
          }
          </style>
        <h2 id="user">API USAGE STATISTICS</h2>
        </html>
    </panel>
  </row>
  <row>
    <panel>
      <table>
        <title>Unique User / Unique Client</title>
        <search>
          <query>index=$indexToken$ AND source="/aws/lambda/g-lambda-au-$stageToken$"  
| stats dc(claims.sub) as "Unique Users", dc(claims.cid) as "Unique Clients" BY claims.cid claims.groups{}
| rename claims.cid AS app, claims.groups{} AS groups
| table app "Unique Users" "Unique Clients" groups</query>
          <earliest>$timeToken.earliest$</earliest>
          <latest>$timeToken.latest$</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <html id="nspCounts">
          <style>
          #user{
          text-align:center;
          color:#BFFF00;
          }
          </style>
        <h2 id="user">NSP STREAM STATISTICS</h2>
        </html>
    </panel>
  </row>
  <row>
    <panel>
      <table>
        <title>Unique Consumer</title>
        <search>
          <query>index="np" source="**"
| spath path=$stageToken$.nsp3s{} output=nsp3s
| sort -_time
| head 1
| mvexpand nsp3s
| spath input=nsp3s path=Name output=Name
| spath input=nsp3s path=DistinctAdminUserCount output=DistinctAdminUserCount
| search Name="*costing*"
| table Name, DistinctAdminUserCount</query>
          <earliest>$timeToken.earliest$</earliest>
          <latest>$timeToken.latest$</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
    <panel>
      <table>
        <title>Event Processed</title>
        <search>
          <query>index="$indexToken$" source="/aws/lambda/publish-$entityToken$-$stageToken$-nsp" "success Published to NSP3 objectType*"
| rex field=msg "objectType\s*:\s*(?&lt;objectType&gt;[^\s]+)" 
| stats count by objectType</query>
          <earliest>$timeToken.earliest$</earliest>
          <latest>$timeToken.latest$</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
    <panel>
      <table>
        <title>Number of Errors</title>
        <search>
          <query>index="$indexToken$" source="/aws/lambda/publish-$entityToken$-$stageToken$-nsp" 
"error*" | stats count</query>
          <earliest>$timeToken.earliest$</earliest>
          <latest>$timeToken.latest$</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <title>API : Data/Search Count</title>
      <html id="errorcount5">
          <style>
          #user{
          text-align:center;
          color:#BFFF00;
          }
          </style>
        <h2 id="user"> API COUNT STATISTICS</h2>
        </html>
    </panel>
  </row>
  <row>
    <panel>
      <title>Total Request Data</title>
      <table>
        <search>
          <query>(index=$indexToken$  source="/aws/lambda/api-data-$stageToken$-$entityToken$" OR source="/aws/lambda/api-commands-$stageToken$-*") ge:*:init:*:invoke
| spath path=event.path output=path
| spath path=event.httpMethod output=http
| eval Path=http + " " + path
|stats count by Path</query>
          <earliest>$timeToken.earliest$</earliest>
          <latest>$timeToken.latest$</latest>
          <refresh>60m</refresh>
          <refreshType>delay</refreshType>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
    <panel>
      <title>Total Request Search</title>
      <table>
        <search>rliest&gt;<query>index=$indexToken$    source IN ("/aws/lambda/api-search-$stageToken$-$entityToken$")   ge:init:*:invoke
| spath path=path output=path
| spath path=httpMethod output=http
| eval Path=http + " " + path
|stats count by Path</query>
          <earliest>$timeToken.earliest$</earliest>
          <latest>$timeToken.latest$</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
    <panel>
      <title>Total Error Count :</title>
      <table>
        <search>rliest&gt;<query>index=$indexToken$    source IN ("/aws/lambda/api-search-$stageToken$-$entityToken$") msg="error*"
(error.status=4* OR error.status=5*)
| eval status=case(like(error.status, "4%"), "4xx", like(error.status, "5%"), "5xx") | stats count by error.status</query>
          <earliest>$timeToken.earliest$</earliest>
          <latest>$timeToken.latest$</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
    <panel>
      <title>Response Time Count in ms</title>
      <table>
        <search>rliest&gt;<query>index=np-papi source IN ("/aws/lambda/api-search-test-*") "ge:init:search:response"
| stats sum(responseTime) as TotalResponseTime, avg(responseTime) as AvgResponseTime
| eval API="Search API"
| eval TotalResponseTime = TotalResponseTime . " ms"
| eval AvgResponseTime = round(AvgResponseTime, 2) . " ms"
| table API, TotalResponseTime, AvgResponseTime
| append [
    search index=np-papi source IN ("/aws/lambda/api-data-test-*") msg="ge:init:data:*"
    | stats sum(responseTime) as TotalResponseTime, avg(responseTime) as AvgResponseTime
    | eval API="DATA API"
    | eval TotalResponseTime = TotalResponseTime . " ms"
    | eval AvgResponseTime = round(AvgResponseTime, 2) . " ms"
    | table API, TotalResponseTime, AvgResponseTime
]
| table API, TotalResponseTime, AvgResponseTime</query>
          <earliest>$timeToken.earliest$</earliest>
          <latest>$timeToken.latest$</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <html id="errorcount16">
          <style>
          #user{
          text-align:center;
          color:#BFFF00;
          }
          </style>
        <h2 id="user">Request per min</h2>
        </html>
    </panel>
  </row>
  <row>
    <panel>
      <table>
        <search>
          <query>index=$indexToken$    source IN ("/aws/lambda/api-data-$stageToken$-$entityToken$","/aws/lambda/api-search-$stageToken$-$entityToken$") "ge:init:*:*"
| timechart span=1m count by source
| untable _time source count
| stats sum(count) as TotalCount, avg(count) as AvgCountPerMin by source
| eval AvgCountPerMin = round(AvgCountPerMin, 2)
| eval source = if(match(source, "api-data-test-(.*)"), replace(source, "/api-data-test-(.*)", "data-\\1"), 
                   if(match(source, "/aws/lambda/api-data-prod-(.*)"), replace(source, "/aws/lambda/api-data-prod-(.*)", "data-\\1"), 
                   if(match(source, "/aws/lambda/api-search-test-(.*)"), replace(source, "/aws/lambda/api-search-test-(.*)", "search-\\1"), 
                   replace(source, "/aws/lambdaapi-search-prod-(.*)", "search-\\1"))))
| table source, TotalCount, AvgCountPerMin</query>
          <earliest>$timeToken.earliest$</earliest>
          <latest>$timeToken.latest$</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <title>SLA % :DATA API</title>
      <table>
        <search>
          <query>index=$indexToken$    source IN ("/aws/lambdaapi-data-$stageToken$-$entityToken$")  "ge:init:data:responseTime"
| eval SLA_threshold = 113 
| eval SLA_compliant = if(responseTime &lt;= SLA_threshold, 1, 0)
| stats count as totalRequests, sum(SLA_compliant) as SLA_passed by source
| eval SLA_percentage = round((SLA_passed / totalRequests) * 100, 2)
| eval API = "DATA API"

| table source, SLA_percentage, totalRequests, SLA_passed</query>
          <earliest>$timeToken.earliest$</earliest>
          <latest>$timeToken.latest$</latest>
          <refresh>60m</refresh>
          <refreshType>delay</refreshType>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
    <panel>
      <title>SLA % :SEARCH API</title>
      <table>
        <search>
          <query>index=$indexToken$    source IN ("/aws/lambda/api-search-$stageToken$-$entityToken$") "ge:init:search:response:time"
| eval SLA_threshold = 100 
| eval SLA_compliant = if(responseTime &lt;= SLA_threshold, 1, 0)
| stats count as totalRequests, sum(SLA_compliant) as SLA_passed by source
| eval SLA_percentage = round((SLA_passed / totalRequests) * 100, 2)
| eval API = "SEARCH API"
| eval source = if(match(source, "/aws/lambda/api-search-test-(.*)"), replace(source, "/aws/lambda\api-search-test-(.*)", "search-\\1"), replace(source, "/aws/lambda/api-search-prod-(.*)", "search-\\1"))
| table source, SLA_percentage, totalRequests, SLA_passed</query>
          <earliest>$timeToken.earliest$</earliest>
          <latest>$timeToken.latest$</latest>
          <refresh>60m</refresh>
          <refreshType>delay</refreshType>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</form>

ITWhisperer · ‎03-29-2025

Please do not tag me - I, like many here, volunteer my time and expertise and it is not for others to suggest what I work on. By specifically addressing people, you are also potentially excluding others who may have valuable contributions to make; it is like you don't value or are not interested in their efforts (since you haven't also directly addressed them). I imagine this can be counter-productive to resolving your issue (whatever that might be)!

View solution in original post

ITWhisperer · ‎03-29-2025

Please do not tag me - I, like many here, volunteer my time and expertise and it is not for others to suggest what I work on. By specifically addressing people, you are also potentially excluding others who may have valuable contributions to make; it is like you don't value or are not interested in their efforts (since you haven't also directly addressed them). I imagine this can be counter-productive to resolving your issue (whatever that might be)!

nithys · ‎03-29-2025

Thank you for your feedback. I appreciate the time and expertise you and others volunteer here. My intention wasn’t to exclude anyone.I’ll keep your advice in mind for future posts to ensure all contributions are valued equally.

And will repost without tagging anyone

dashboard submit button

Classic dashboard

Dashboard Studio

Enterprise Security Content Update (ESCU) | New Releases

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

It’s go time — Boston, here we come!

Are you a member of the Splunk Community?