Getting Data In

Pass tokens from multiselect dropdown to charts

anooshac
Communicator

Hi all,

I have a multiselect dropdown to list all the  groups, also i have 2 pie charts for the number of tasks per groups and status of the jobs of tasks.Default selection in the multiselect dropdown is "All". How to pass the tokens from the mutiselect to the charts?

The queries for 2 charts are,

index= "abc" sourcetype="xyz"|chart distinct_count(task) as Tasks by group

The status pie chart is drilldown from the first pie chart. Tok_task is passe as token.

index= "abc" sourcetype="xyz"| search task= $Tok_task$| chart distinct_count(job) as Jobs by status

I just simply passed a token from multiselect to the chart. It is not working as i select multiple options. Does anyone know how to work with this?

Labels (1)
0 Karma
1 Solution

anooshac
Communicator

Hi all,

I got the solution for this. Added the multiselect token like this in the query.

index= "abc" sourcetype="xyz"|search group IN ($Tok_group$)|chart distinct_count(task) as Tasks by group

index= "abc" sourcetype="xyz"|search group IN ($Tok_group$)| search task= $Tok_task$| chart distinct_count(job) as Jobs by status

View solution in original post

0 Karma

jhanvidattani
Path Finder

Can you execute the SPL of the panel so it could be more clear what value is being passed in token or share the XML code over here so we can look into it.

0 Karma

anooshac
Communicator

I can't post the actual queries here.. I have changed the parameters. this query below constructs the values for mutliselect dropown.

index= "abc" sourcetype="xyz"|dedup group|table group

The pie chart is constructed using this query.

index= "abc" sourcetype="xyz"|chart distinct_count(task) as Tasks by group

The second pie chart is drilldown from the first pie chart. It is created using this query,"Tok_task" is passed as token from the above pie chart.

index= "abc" sourcetype="xyz"| search task= $Tok_task$| chart distinct_count(job) as Jobs by status

I want to pass tokens from the multiselect dropdown, so that the values selected will be reflected in the pie charts. I used token from the multiselect dropdown directly in the queries but it is not working as i select more values. Still confused on how to proceed with..

0 Karma

anooshac
Communicator

Hi all,

I got the solution for this. Added the multiselect token like this in the query.

index= "abc" sourcetype="xyz"|search group IN ($Tok_group$)|chart distinct_count(task) as Tasks by group

index= "abc" sourcetype="xyz"|search group IN ($Tok_group$)| search task= $Tok_task$| chart distinct_count(job) as Jobs by status

0 Karma

jhanvidattani
Path Finder

@anooshac 

Can you refer to below code for the solution:

<form>
  <label>test</label>
  <fieldset submitButton="false">
    <input type="time" token="time_token">
      <label>Time range</label>
      <default>
        <earliest>-15m</earliest>
        <latest>now</latest>
      </default>
    </input>
    <input type="multiselect" token="source_token" searchWhenChanged="true">
      <label>Sourcetype</label>
      <delimiter> OR </delimiter>
      <fieldForLabel>sourcetype</fieldForLabel>
      <fieldForValue>sourcetype</fieldForValue>
      <choice value="*">All</choice>
      <search>
        <query>index="_internal" | stats count by sourcetype </query>
        <earliest>$time_token.earliest$</earliest>
        <latest>$time_token.latest$</latest>
      </search>
      <default>*</default>
      <initialValue>*</initialValue>
      <valuePrefix>sourcetype=</valuePrefix>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <title>Associated Source</title>
        <search>
          <query>index="_internal" $source_token$ | stats Count by source | rename source as Source</query>
          <earliest>$time_token.earliest$</earliest>
          <latest>$time_token.latest$</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</form>

 

If you find my solution fruitful, an upvote would be appreciated.

0 Karma

anooshac
Communicator

Thanks for replying.. I tried the same and it works only for one input. When i select multiple inputs from the multiselect dropdown the chart shows no results found. Not sure how to solve this.

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>