hello,
i have a dashboard with multiselect input and dropdown input but for some reason they are both greyed out and the search is not updating after selecting at the first time.
also i have no option to configure default value for both of them
<form>
<label>List of Pause Events with Times</label>
<fieldset submitButton="false">
<input type="multiselect" token="serialnumber" searchWhenChanged="false">
<label>Serial Number</label>
<prefix>SerialNumber = </prefix>
<fieldForLabel>sn</fieldForLabel>
<fieldForValue>sn</fieldForValue>
<search>
<query>index="emea_fdm" | `SerialNumber`</query>
<earliest>0</earliest>
<latest></latest>
</search>
<delimiter>OR</delimiter>
</input>
<input type="dropdown" token="sourcetype" searchWhenChanged="false">
<label>Source Type</label>
<prefix>sourcetype = "</prefix>
<suffix>"</suffix>
<fieldForLabel>st</fieldForLabel>
<fieldForValue>st</fieldForValue>
<search>
<query>index="emea_fdm" sourcetype="fdm_*_system"</query>
<earliest>0</earliest>
<latest></latest>
</search>
</input>
</fieldset>
<row>
<panel>
<title>EMEA</title>
<table>
<search ref="List of Pause Events with Times"></search>
<option name="count">20</option>
<option name="drilldown">cell</option>
<drilldown>
<link target="_blank">/app/St/report?s=SSYS-List%20of%20Pause%20Events%20with%20Times</link>
</drilldown>
</table>
</panel>
</row>
</form>
@sarit_s
Can you please confirm your searches are returning results?
index="emea_fdm" | `SerialNumber`
index="emea_fdm" sourcetype="fdm_*_system"
[Updated]
The issue is resolved.
The serialnumber macro was missing. We have updated searches during troubleshooting. All the followed troubleshooting steps are mentioned in the below comments.
Happy Splunking
@sarit_s
I found a typo in the token can you please try with below code?
<search>
<query>index="$Region$_fdm" sourcetype=$sourcetype$ pauseReason: NOT "pauseReason: NotPaused" pauseReason: NOT "pauseReason: UserPaused" |`SerialNumber`=$serialNumber$| `pauseReason` | table _time pause_reason SerialNumber sourcetype source</query>
<earliest>0</earliest>
<latest></latest>
</search>
oh my god . i feel so stupid ![]()
how can i show in the table the serialNumber list ? if i do like this:
table _time pause_reason $serialNumber$ sourcetype source
then it shows the serialNumber as title in the table.
also, i can i achieve the same results but with multiselect ?
Can you please tell me what macros do??
And how you want to display SerialNumber list? You can display it in multivalued field but still, want to know from you/.
macros has regex behind them
for example SerialNumber --> rex field=source \/ssyssplunk\/\w+\/\w+\/\w+\/\w+\/(?<SerialNumber>\w+)
i want to display them as some kind of list, don't really care which one but not as checkbox since i have many of them and i want it to be clean
i want to summerize the issues:
1. i want serialNumber to be some kind of multiselect list
2. i want to be able to show the selected serialNumber in the table. now it is showing me the serialNumber as table column title
3. the option "ALL" in not working. configuring NAME=ALL Value=* returning error that * is not supported.
many thanks !!
Are you extracting SerialNumber from source field?? Is it extracting properly?? Is it single or multivalued?
Do you want to make SerialNumber drop down multi select?
What |SerialNumber=$serialNumber$ does?
im answering in bold so it will be more readable
Are you extracting SerialNumber from source field?? yes
Is it extracting properly?? yes
Is it single or multivalued? each source has one serialNumber
Do you want to make SerialNumber drop down multi select? yes
What |SerialNumber=$serialNumber$ does? it was a test but it is not working. i tried to set the selected serialNumber to parameter
@sarit_s
Can you please try this?
<form>
<label>panel test</label>
<fieldset submitButton="false">
<input type="dropdown" token="Region" searchWhenChanged="true">
<label>Region</label>
<choice value="ALL">ALL</choice>
<choice value="EMEA">EMEA</choice>
<choice value="APJ">APJ</choice>
</input>
<input type="dropdown" token="sourcetype" searchWhenChanged="true">
<label>SourceType</label>
<choice value="ALL">ALL</choice>
<fieldForLabel>sourcetype</fieldForLabel>
<fieldForValue>sourcetype</fieldForValue>
<search>
<query>index="$Region$_fdm" sourcetype="fdm_*_system" |dedup sourcetype |table sourcetype</query>
<earliest>0</earliest>
<latest></latest>
</search>
</input>
<input type="multiselect" token="serialNumber" searchWhenChanged="true">
<label>SerialNumber</label>
<choice value="ALL">ALL</choice>
<fieldForLabel>SerialNumber</fieldForLabel>
<fieldForValue>SerialNumber</fieldForValue>
<search>
<query>index="$Region$_fdm" sourcetype=$sourcetype$ | rex field=source \/ssyssplunk\/\w+\/\w+\/\w+\/\w+\/(?<SerialNumber>\w+) | dedup SerialNumber |table SerialNumber</query>
<earliest>0</earliest>
<latest></latest>
</search>
<delimiter> ,</delimiter>
<valuePrefix>"</valuePrefix>
<valueSuffix>"</valueSuffix>
</input>
</fieldset>
<row>
<panel>
<title>paused reasons by Region</title>
<table>
<title>$Region$</title>
<search>
<query>index="$Region$_fdm" sourcetype=$sourcetype$ pauseReason: NOT "pauseReason: NotPaused" pauseReason: NOT "pauseReason: UserPaused" |`SerialNumber` | search SerialNumber IN ($serialNumber$) | `pauseReason` | table _time pause_reason SerialNumber sourcetype source</query>
<earliest>0</earliest>
<latest></latest>
</search>
<option name="count">10</option>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
</form>
im getting "No Result Found"
Can you please debug "paused reasons by Region" search by opening in search? At which level events get removed from the result.
if im changing "region" i see it changing in "paused reasons by Region"
if im changing sourcetype i see it changing in the table and also refreshing the serialnumber dropdown
the "no result" coming when "playing" with serialnumber in the table query
Can you please share search after selecting serialnumber ?
index="ssys_$Region$_fdm" sourcetype=$sourcetype$ pauseReason: NOT "pauseReason: NotPaused" pauseReason: NOT "pauseReason: UserPaused" |search SerialNumber IN ($serialNumber$) | `pauseReason`| table _time pause_reason SerialNumber sourcetype source
this is what you mean ?
No
In "paused reasons by Region" panel you will find 4 options at the bottom right.
Just click on the first option for our required search.
oh, sorry
index="EMEA_fdm" sourcetype=fdm_f370_system pauseReason: NOT "pauseReason: NotPaused" pauseReason: NOT "pauseReason: UserPaused" |search SerialNumber IN ("D00015" ,"D00507") | `pauseReason`| table _time pause_reason SerialNumber sourcetype source
found the problem
for some reason the serialnumber macro was missing
everything is working now
thank you so much !!
@sarit_s
Did you solve the problem??
yes. please set you answer as comment so i will be able to approve
@sarit_s
I have converted comment in the answer and updated content. Please upvote the my comments which is useful or helpful to you and accept it.
Thanks
:)
also i found out that changing serialNumber refreshing the panel but not the results
so for each serialNumber im getting the same results
Serial Number
Search produced no results.
Source Type
Select...
Could not create search.
Unknown search command 'head10'.