Pass tokens from multiselect dropdown to charts

[anooshac]

Hi all,

I have a multiselect dropdown to list all the  groups, also i have 2 pie charts for the number of tasks per groups and status of the jobs of tasks.Default selection in the multiselect dropdown is "All". How to pass the tokens from the mutiselect to the charts?

The queries for 2 charts are,

index= "abc" sourcetype="xyz"|chart distinct_count(task) as Tasks by group

The status pie chart is drilldown from the first pie chart. Tok_task is passe as token.

index= "abc" sourcetype="xyz"| search task= $Tok_task$| chart distinct_count(job) as Jobs by status

I just simply passed a token from multiselect to the chart. It is not working as i select multiple options. Does anyone know how to work with this?

[jhanvidattani]

Can you execute the SPL of the panel so it could be more clear what value is being passed in token or share the XML code over here so we can look into it.

[anooshac]

I can't post the actual queries here.. I have changed the parameters. this query below constructs the values for mutliselect dropown.

index= "abc" sourcetype="xyz"|dedup group|table group

The pie chart is constructed using this query.

index= "abc" sourcetype="xyz"|chart distinct_count(task) as Tasks by group

The second pie chart is drilldown from the first pie chart. It is created using this query,"Tok_task" is passed as token from the above pie chart.

index= "abc" sourcetype="xyz"| search task= $Tok_task$| chart distinct_count(job) as Jobs by status

I want to pass tokens from the multiselect dropdown, so that the values selected will be reflected in the pie charts. I used token from the multiselect dropdown directly in the queries but it is not working as i select more values. Still confused on how to proceed with..

[anooshac · Accepted solution]

Hi all,

I got the solution for this. Added the multiselect token like this in the query.

index= "abc" sourcetype="xyz"|search group IN ($Tok_group$)|chart distinct_count(task) as Tasks by group

index= "abc" sourcetype="xyz"|search group IN ($Tok_group$)| search task= $Tok_task$| chart distinct_count(job) as Jobs by status

[jhanvidattani]

@anooshac 

Can you refer to below code for the solution:

<form>
  <label>test</label>
  <fieldset submitButton="false">
    <input type="time" token="time_token">
      <label>Time range</label>
      <default>
        <earliest>-15m</earliest>
        <latest>now</latest>
      </default>
    </input>
    <input type="multiselect" token="source_token" searchWhenChanged="true">
      <label>Sourcetype</label>
      <delimiter> OR </delimiter>
      <fieldForLabel>sourcetype</fieldForLabel>
      <fieldForValue>sourcetype</fieldForValue>
      <choice value="*">All</choice>
      <search>
        <query>index="_internal" | stats count by sourcetype </query>
        <earliest>$time_token.earliest$</earliest>
        <latest>$time_token.latest$</latest>
      </search>
      <default>*</default>
      <initialValue>*</initialValue>
      <valuePrefix>sourcetype=</valuePrefix>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <title>Associated Source</title>
        <search>
          <query>index="_internal" $source_token$ | stats Count by source | rename source as Source</query>
          <earliest>$time_token.earliest$</earliest>
          <latest>$time_token.latest$</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</form>

If you find my solution fruitful, an upvote would be appreciated.

[anooshac]

Thanks for replying.. I tried the same and it works only for one input. When i select multiple inputs from the multiselect dropdown the chart shows no results found. Not sure how to solve this.