Dashboards & Visualizations

dropdown and multiselect greyed out

sarit_s
Communicator

hello,
i have a dashboard with multiselect input and dropdown input but for some reason they are both greyed out and the search is not updating after selecting at the first time.
also i have no option to configure default value for both of them

<form>
  <label>List of Pause Events with Times</label>
  <fieldset submitButton="false">
    <input type="multiselect" token="serialnumber" searchWhenChanged="false">
      <label>Serial Number</label>
      <prefix>SerialNumber = </prefix>
      <fieldForLabel>sn</fieldForLabel>
      <fieldForValue>sn</fieldForValue>
      <search>
        <query>index="emea_fdm" | `SerialNumber`</query>
        <earliest>0</earliest>
        <latest></latest>
      </search>
      <delimiter>OR</delimiter>
    </input>
    <input type="dropdown" token="sourcetype" searchWhenChanged="false">
      <label>Source Type</label>
      <prefix>sourcetype = "</prefix>
      <suffix>"</suffix>
      <fieldForLabel>st</fieldForLabel>
      <fieldForValue>st</fieldForValue>
      <search>
        <query>index="emea_fdm" sourcetype="fdm_*_system"</query>
        <earliest>0</earliest>
        <latest></latest>
      </search>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>EMEA</title>
      <table>
        <search ref="List of Pause Events with Times"></search>
        <option name="count">20</option>
        <option name="drilldown">cell</option>
        <drilldown>
          <link target="_blank">/app/St/report?s=SSYS-List%20of%20Pause%20Events%20with%20Times</link>
        </drilldown>
      </table>
    </panel>
  </row>
</form>
Tags (1)
0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

@sarit_s

Can you please confirm your searches are returning results?

index="emea_fdm" | `SerialNumber`


index="emea_fdm" sourcetype="fdm_*_system"

[Updated]

The issue is resolved.

The serialnumber macro was missing. We have updated searches during troubleshooting. All the followed troubleshooting steps are mentioned in the below comments.

Happy Splunking

View solution in original post

kamlesh_vaghela
SplunkTrust
SplunkTrust

@sarit_s

I found a typo in the token can you please try with below code?

<search>
           <query>index="$Region$_fdm"  sourcetype=$sourcetype$ pauseReason: NOT "pauseReason: NotPaused" pauseReason: NOT "pauseReason: UserPaused" |`SerialNumber`=$serialNumber$| `pauseReason` | table _time pause_reason SerialNumber sourcetype source</query>
           <earliest>0</earliest>
           <latest></latest>
         </search>
0 Karma

sarit_s
Communicator

oh my god . i feel so stupid :slightly_smiling_face:

how can i show in the table the serialNumber list ? if i do like this:
table _time pause_reason $serialNumber$ sourcetype source
then it shows the serialNumber as title in the table.

also, i can i achieve the same results but with multiselect ?

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

Can you please tell me what macros do??
And how you want to display SerialNumber list? You can display it in multivalued field but still, want to know from you/.

0 Karma

sarit_s
Communicator

macros has regex behind them
for example SerialNumber --> rex field=source \/ssyssplunk\/\w+\/\w+\/\w+\/\w+\/(?<SerialNumber>\w+)

i want to display them as some kind of list, don't really care which one but not as checkbox since i have many of them and i want it to be clean

i want to summerize the issues:
1. i want serialNumber to be some kind of multiselect list
2. i want to be able to show the selected serialNumber in the table. now it is showing me the serialNumber as table column title
3. the option "ALL" in not working. configuring NAME=ALL Value=* returning error that * is not supported.

many thanks !!

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

Are you extracting SerialNumber from source field?? Is it extracting properly?? Is it single or multivalued?

Do you want to make SerialNumber drop down multi select?

What |SerialNumber=$serialNumber$ does?

0 Karma

sarit_s
Communicator

im answering in bold so it will be more readable
Are you extracting SerialNumber from source field?? yes
Is it extracting properly?? yes
Is it single or multivalued? each source has one serialNumber

Do you want to make SerialNumber drop down multi select? yes

What |SerialNumber=$serialNumber$ does? it was a test but it is not working. i tried to set the selected serialNumber to parameter

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@sarit_s

Can you please try this?

<form>
<label>panel test</label>
   <fieldset submitButton="false">
     <input type="dropdown" token="Region" searchWhenChanged="true">
       <label>Region</label>
       <choice value="ALL">ALL</choice>
       <choice value="EMEA">EMEA</choice>
       <choice value="APJ">APJ</choice>
     </input>
     <input type="dropdown" token="sourcetype" searchWhenChanged="true">
       <label>SourceType</label>
       <choice value="ALL">ALL</choice>
       <fieldForLabel>sourcetype</fieldForLabel>
       <fieldForValue>sourcetype</fieldForValue>
       <search>
         <query>index="$Region$_fdm" sourcetype="fdm_*_system" |dedup sourcetype |table sourcetype</query>
         <earliest>0</earliest>
         <latest></latest>
       </search>
     </input>
    <input type="multiselect" token="serialNumber" searchWhenChanged="true">
      <label>SerialNumber</label>
      <choice value="ALL">ALL</choice>
      <fieldForLabel>SerialNumber</fieldForLabel>
      <fieldForValue>SerialNumber</fieldForValue>
      <search>
        <query>index="$Region$_fdm" sourcetype=$sourcetype$ | rex field=source \/ssyssplunk\/\w+\/\w+\/\w+\/\w+\/(?&lt;SerialNumber&gt;\w+) | dedup SerialNumber |table SerialNumber</query>
        <earliest>0</earliest>
        <latest></latest>
      </search>
      <delimiter> ,</delimiter>
      <valuePrefix>"</valuePrefix>
      <valueSuffix>"</valueSuffix>
    </input>
   </fieldset>
   <row>
     <panel>
       <title>paused reasons by Region</title>
       <table>
         <title>$Region$</title>
         <search>
           <query>index="$Region$_fdm"  sourcetype=$sourcetype$ pauseReason: NOT "pauseReason: NotPaused" pauseReason: NOT "pauseReason: UserPaused" |`SerialNumber` | search SerialNumber IN ($serialNumber$)  | `pauseReason` | table _time pause_reason SerialNumber sourcetype source</query>
           <earliest>0</earliest>
           <latest></latest>
         </search>
         <option name="count">10</option>
         <option name="drilldown">none</option>
         <option name="refresh.display">progressbar</option>
       </table>
     </panel>
   </row>
 </form>
0 Karma

sarit_s
Communicator

im getting "No Result Found"

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

Can you please debug "paused reasons by Region" search by opening in search? At which level events get removed from the result.

0 Karma

sarit_s
Communicator

if im changing "region" i see it changing in "paused reasons by Region"
if im changing sourcetype i see it changing in the table and also refreshing the serialnumber dropdown
the "no result" coming when "playing" with serialnumber in the table query

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

Can you please share search after selecting serialnumber ?

0 Karma

sarit_s
Communicator
index="ssys_$Region$_fdm" sourcetype=$sourcetype$ pauseReason: NOT "pauseReason: NotPaused" pauseReason: NOT "pauseReason: UserPaused" |search SerialNumber IN ($serialNumber$)  | `pauseReason`| table _time pause_reason SerialNumber sourcetype source

this is what you mean ?

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

No

In "paused reasons by Region" panel you will find 4 options at the bottom right.

  1. Open in Search
  2. Export
  3. Inspect
  4. Refresh

Just click on the first option for our required search.

0 Karma

sarit_s
Communicator

oh, sorry

index="EMEA_fdm" sourcetype=fdm_f370_system pauseReason: NOT "pauseReason: NotPaused" pauseReason: NOT "pauseReason: UserPaused" |search SerialNumber IN ("D00015" ,"D00507")  | `pauseReason`| table _time pause_reason SerialNumber sourcetype source
0 Karma

sarit_s
Communicator

found the problem
for some reason the serialnumber macro was missing
everything is working now
thank you so much !!

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@sarit_s

Did you solve the problem??

0 Karma

sarit_s
Communicator

yes. please set you answer as comment so i will be able to approve

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@sarit_s

I have converted comment in the answer and updated content. Please upvote the my comments which is useful or helpful to you and accept it.

Thanks
:)

0 Karma

sarit_s
Communicator

also i found out that changing serialNumber refreshing the panel but not the results
so for each serialNumber im getting the same results

0 Karma

sarit_s
Communicator

Serial Number
Search produced no results.
Source Type

Select...
Could not create search.
Unknown search command 'head10'.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...