Splunk Search

Error - search is waiting for the input

smanojkumar
Contributor

Hi There!

   I'm facing the error "Search is waiting for the input"

<form stylesheet="dashboard.css,infobutton.css" script="multiselect_functions.js,infobutton.js" version="1.1" theme="dark">
  <label>Agent Operational Dashboard</label>
  <description>v4.3</description>
  <init>
    <set token="agent_index">1T</set>
    <set token="console_stand_scope">OR `console_stand(*)`</set>
              <set token="form.cacp">*</set>
              <set token="form.sap">*</set>
              <set token="form.origin">*</set>
  </init>
  <search id="init">
    <done>
      <condition match="isnull($scope$) OR $scope$ == &quot;agent_console_&quot;">
        <set token="cmdb_scope">*</set>
      </condition>
      <condition match="$scope$ == &quot;agent_cmdb_&quot;">
        <set token="cmdb_scope">IN</set>
      </condition>
    </done>
    <query>
      | makeresults
    </query>
    <earliest>$search_start$</earliest>
    <latest>$search_end$</latest>
  </search>
  <search>
    <query>
      | makeresults
      | eval LimitVersion_ens=`get_obsolete_version(Agent_Endpoint_Security)`
      | eval LimitVersion_agent=`get_obsolete_version(Agent_Agent)`
    </query>
    <done>
      <set token="ens_obsolete_version">$result.LimitVersion_ens$</set>
      <set token="agent_obsolete_version">$result.LimitVersion_agent$</set>
    </done>
  </search>
  <search id="compliance_agent">
    <query>
      `compliance_agent_op("agent_index_source IN($agent_index$) $console_stand_scope$", now(), $timerange$, agent,$machine$, $scope$, $origin$, $country$, $cacp$, $sap$)`
    </query>
    <earliest>$search_start$</earliest>
    <latest>$search_end$</latest>
  </search>
  <search id="compliance_all_agent">
    <query>
      `compliance_agent_op("`agent_scope_filter($cmdb_scope$)`", now(), $timerange$, agent,$machine$, $scope$, $origin$, $country$, $cacp$, $sap$)`
    </query>
    <earliest>$search_start$</earliest>
    <latest>$search_end$</latest>
  </search>
  <search>
    <done>
      <set token="search_start">$result.search_start$</set>
      <set token="search_end">$result.search_end$</set>
    </done>
    <query>| makeresults
| fields - _time
| eval now=now()
| eval prev_day=if(strftime(now, "%a")="Mon" AND "$weekends$"="exclude", -3, -1)
| eval search_start=relative_time(now, prev_day."d@d")
| eval search_end=search_start + 86400</query>
  </search>
  <fieldset submitButton="false" autoRun="true">
    <input type="multiselect" token="agent_index" searchWhenChanged="true">
      <label>Choose Agent console</label>
      <choice value="1T,2A*,2S">All</choice>
      <choice value="1T">Agent Stand</choice>
      <choice value="2A*">Agent Scad</choice>
      <choice value="2S">Agent SCAPA</choice>
      <default>1T</default>
      <initialValue>1T</initialValue>
      <delimiter>, </delimiter>
      <change>
        <set token="agent_index_label">$label$</set>
      </change>
      <change>
        <condition match="like($agent_index$,&quot;%1T23%&quot;)">
          <set token="console_stand_scope">OR `console_stand($cmdb_scope$)`</set>
        </condition>
        <condition match="!like($agent_index$,&quot;%1T23%&quot;)">
          <set token="console_stand_scope"></set>
        </condition>
      </change>
    </input>
    <input type="dropdown" token="timerange"  searchWhenChanged="true">
      <label>Last Communication</label>
      <choice value="-1d@d">Previous day</choice>
      <choice value="-7d@d">Last 7 days</choice>
      <choice value="-15d@d">Last 15 days</choice>
      <choice value="-21d@d">Last 21 days</choice>
      <choice value="-30d@d">Last 30 days</choice>
      <choice value="-3mon">Last 3 months</choice>
      <choice value="-6mon">Last 6 months</choice>
      <choice value="-12mon">Last 1 year</choice>
      <change>
        <eval token="time_timechart">case($value$ == "-1d@d","1",$value$ == "-7d@d","2",$value$ == "-15d@d","3",$value$ == "-21d@d","4",$value$ == "-30d@d","5",$value$ == "-3mon","6",$value$ == "-6mon","7",$value$ == "-12mon","8")</eval>
      </change>
      <default>-15d@d</default>
      <initialValue>-15d@d</initialValue>
    </input>
    <input type="radio" token="origin"  searchWhenChanged="true">
      <label>Location</label>
      <choice value="*">All Locations</choice>
      <choice value="NAT">NAT</choice>
      <choice value="ROO">ROO</choice>
      <default>*</default>
      <initialValue>*</initialValue>
      <change>
        <unset token="form.country"></unset>
      </change>
    </input>
    <input type="multiselect" token="country"  searchWhenChanged="true">
      <label>Country</label>
      <search>
        <query>| inputlookup b1a_asset_country.csv where nat_roo="$origin$"
        | dedup country
        | fields country </query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
      <delimiter> </delimiter>
      <fieldForLabel>country</fieldForLabel>
      <fieldForValue>country</fieldForValue>
      <choice value="*">All</choice>
      <default>*</default>
      <initialValue>*</initialValue>
    </input>
    <input type="multiselect" token="machine"  searchWhenChanged="true">
      <label>Machine type</label>
      <choice value="*">All</choice>
      <choice value="VDI">VDI</choice>
      <choice value="Industrial">Industrial</choice>
      <choice value="Stand">Stand</choice>
      <choice value="MacOS">MacOS</choice>
      <default>*</default>
      <initialValue>*</initialValue>
    </input>
    <input type="radio" token="business_assets" searchWhenChanged="true">
      <label>Business assets</label>
      <choice value="*">All assets</choice>
      <choice value="cacp">CACP</choice>
                <choice value="sap">SAP</choice>
      <default>*</default>
      <initialValue>*</initialValue>
                <change>
        <condition match="$business_assets$ == &quot;cacp&quot;">
          <set token="cacp">true</set>
          <set token="sap">*</set>
        </condition>
                             <condition match="$business_assets$ == &quot;sap&quot;">
          <set token="sap">true</set>
          <set token="cacp">*</set>
        </condition>
                             <condition match="$business_assets$ == &quot;*&quot;">
          <set token="sap">*</set>
          <set token="cacp">*</set>
        </condition>
      </change>
    </input>
    <input type="dropdown" token="scope" searchWhenChanged="true">
      <label>Scope</label>
      <choice value="agent_console_">Agent Console</choice>
      <choice value="agent_cmdb_">CMDB</choice>
      <default>agent_console_</default>
      <initialValue>agent_console_</initialValue>
      <change>
        <condition match="$scope$ == &quot;agent_console_&quot;">
          <unset token="cmdb_scope"></unset>
          <set token="cmdb_scope">*</set>
        </condition>
        <condition match="$scope$ == &quot;agent_cmdb_&quot;">
          <unset token="cmdb_scope"></unset>
          <set token="cmdb_scope">IN</set>
        </condition>
      </change>
    </input>
    <input type="multiselect" token="office_filter" searchWhenChanged="true">
      <label>Front/Back office (only Stand Global compliance)</label>
      <choice value="Front Office">Front Office</choice>
      <choice value="Back Office">Back Office</choice>
      <initialValue>Front Office,Back Office</initialValue>
      <default>Front Office,Back Office</default>
      <valuePrefix>"</valuePrefix>
      <valueSuffix>"</valueSuffix>
      <delimiter>, </delimiter>
      <change>
        <eval token="office_filter_drilldown">replace($form.office_filter$ + "","([^,]+),?","&amp;form.office_filter=$1")</eval>
      </change>
    </input>
    <input type="radio" token="weekends" searchWhenChanged="true">
      <label>Weekends</label>
      <choice value="exclude">Exclude Weekends</choice>
      <choice value="include">Include Weekends</choice>
      <default>exclude</default>
      <initialValue>exclude</initialValue>
    </input>
  </fieldset>

  <row>
    <panel>
      <title>Full Perimeter Compliance (all EPO)</title>
      <chart>
        <title>All Consoles</title>
        <search base="compliance_all_agent">
          <query>| chart count by $scope$global_compliance
| sort $scope$global_compliance</query>
        </search>
        <option name="charting.chart">pie</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.fieldColors">{"Compliant":0x55AA55,"Non Compliant":0xCC0000","Not Applicable":"0xFFC300 "}</option>
        <option name="charting.seriesColors">[0x55AA55, 0xCC0000]</option>
        <option name="refresh.display">progressbar</option>
        <drilldown>
          <link target="_blank">/app/agent_operational_antivirus_details?form.compliance_filter=$click.value$&amp;form.agent_index=*&amp;form.timerange=$timerange$&amp;form.antivirus_filter=*&amp;form.machine=$machine$&amp;form.origin=$origin$&amp;form.country=$country$&amp;form.business_assets=$business_assets$&amp;form.scope=$scope$</link>
        </drilldown>
      </chart>
    </panel>
  </row>




Thanks in Advance!!!!

0 Karma

richgalloway
SplunkTrust
SplunkTrust

That message appears when a query uses a token that has no value.  Check all tokens in the dashboard to make sure they are defined before the query executes.  Perhaps there is a spelling error somewhere.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...