Splunk Search

How to get dynamic inputs through a query in Dashboard studio?

_pravin
Communicator

Hi,

I am trying to implement a dynamic input dropdown using a query in the dashboard studio.
The code I am using is as follows:

        "input_H05frgOO": {
            "options": {
                "items": [],
                "token": "host_token",
                "defaultValue": ""
            },
            "title": "HOST",
            "type": "input.dropdown",
            "dataSources": {
                "primary": "ds_ljNWYr7J"
            }
        }

And below is the data sources:

        "ds_ljNWYr7J": {
            "type": "ds.search",
            "options": {
                "query": "| mstats avg(\"mx.process.cpu.utilization\") as X WHERE index=\"murex_metrics\" span=10s BY \"mx.env\" | dedup mx.env | table mx.env"
            },
            "name": "search_6"
        }

The input dropdown says "waiting for input".

Could you please help me with the issue?

 

Regards,
Pravin

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

You no longer have the global_time input which is added when you first created the dashboard in Studio

	"inputs": {
		"input_global_trp": {
			"type": "input.timerange",
			"options": {
				"token": "global_time",
				"defaultValue": "-24h@h,now"
			},
			"title": "Global Time Range"
		}
	},

Consequently, when your defaults section references it

	"defaults": {
		"dataSources": {
			"ds.search": {
				"options": {
					"queryParameters": {
						"latest": "$global_time.latest$",
						"earliest": "$global_time.earliest$"
					}
				}
			}
		}
	},

and you don't override the defaults in your searches, the searches are waiting for this token to be completed (which it never will because you deleted the input)!

Either change or remove the default queryParameters or override them in each search.

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

You don't appear to have any query parameters set for your search so what defaults have you got - perhaps these have been left from when the dashboard was created but the input no longer exists?

 

	"defaults": {
		"dataSources": {
			"ds.search": {
				"options": {
					"queryParameters": {
						"latest": "$global_time.latest$",
						"earliest": "$global_time.earliest$"
					}
				}
			}
		}
	},

 

0 Karma

_pravin
Communicator

Hi @ITWhisperer ,

 

I do have the default dataSources but didn't add them due to the restrictions on the number of characters.

{
	"visualizations": {
		"viz_rEigUEIR": {
			"type": "splunk.singlevalue",
			"options": {},
			"dataSources": {
				"primary": "ds_RsGANSf0"
			}
		},
		"viz_zmabNRJy": {
			"type": "splunk.singlevalue",
			"options": {},
			"dataSources": {
				"primary": "ds_zljEkcGY"
			}
		},
		"viz_AOddcf4l": {
			"type": "splunk.singlevalue",
			"options": {},
			"dataSources": {
				"primary": "ds_EIcGt3S9"
			}
		},
		"viz_sAOkMNEW": {
			"type": "splunk.singlevalue",
			"options": {},
			"dataSources": {
				"primary": "ds_Qac6WE2F"
			}
		},
		"viz_EvhBsJbp": {
			"type": "splunk.column",
			"options": {},
			"dataSources": {
				"primary": "ds_a0sVgSvn"
			}
		},
		"viz_YSosdreZ": {
			"type": "splunk.fillergauge",
			"options": {},
			"dataSources": {
				"primary": "ds_EmopXHob"
			}
		},
		"viz_4hVtGw0o": {
			"type": "splunk.fillergauge",
			"options": {},
			"dataSources": {
				"primary": "ds_by7ATPra"
			}
		},
		"viz_eRVtRn07": {
			"type": "splunk.pie",
			"options": {},
			"dataSources": {
				"primary": "ds_SqaTby3h"
			}
		},
		"viz_KROrPVIl": {
			"type": "splunk.table",
			"options": {}
		}
	},
	"dataSources": {
		"ds_RsGANSf0": {
			"type": "ds.search",
			"options": {
				"query": "|  stats max(requestDurationMs) \n    | appendpipe \n    [ stats count \n    | eval \"NoResults\"=\"No Requests Found\" \n    | where count=0 \n    | table \"NoResults\"]"
			},
			"name": "Max Request Duration"
		},
		"ds_zljEkcGY": {
			"type": "ds.search",
			"options": {
				"query": "| eval NEW_TIME = now() - _time \n| where NEW_TIME < 10 \n| stats count(requestDurationMs) \n| appendpipe \n    [ stats count \n    | eval \"NoResults\"=\"No Requests Found\" \n    | where count=0 \n    | table \"NoResults\"]"
			},
			"name": "Requests in the last 10s"
		},
		"ds_TzAuc20h_ds_RsGANSf0": {
			"type": "ds.search",
			"options": {
				"query": "|  stats max(requestDurationMs) \n    | appendpipe \n    [ stats count \n    | eval \"NoResults\"=\"No Requests Found\" \n    | where count=0 \n    | table \"NoResults\"]"
			},
			"name": "Max Request Duration copy 1"
		},
		"ds_EIcGt3S9": {
			"type": "ds.search",
			"options": {
				"query": "| stats count(requestDurationMs) as count \n| eval count=count \n| appendpipe \n    [| eval \"NoResults\"=\"No Requests Found\" \n    | where count=0 \n    | table \"NoResults\"]"
			},
			"name": "Request Frequency"
		},
		"ds_Qac6WE2F": {
			"type": "ds.search",
			"options": {
				"query": "| search (returnCode=\"4*\" OR returnCode=\"5*\") \n| stats count as failedRequestNb \n| appendpipe \n    [| eval \"NoResults\"=\"No Requests Found\" \n    | where count=0 \n    | table \"NoResults\"]"
			},
			"name": "Search_1"
		},
		"ds_a0sVgSvn": {
			"type": "ds.search",
			"options": {
				"query": "| table _time requestDurationMs"
			},
			"name": "Search_2"
		},
		"ds_EmopXHob": {
			"type": "ds.search",
			"options": {
				"query": "| eval NEW_TIME = now() - _time \n| where NEW_TIME < 10 \n| stats count(requestDurationMs) \n| appendpipe \n    [ stats count \n    | eval \"NoResults\"=\"No Requests Found\" \n    | where count=0 \n    | table \"NoResults\"]"
			},
			"name": "Search_3"
		},
		"ds_by7ATPra": {
			"type": "ds.search",
			"options": {
				"query": "| stats count(requestDurationMs) as count \n| eval count=count \n| appendpipe \n    [| eval \"NoResults\"=\"No Requests Found\" \n    | where count=0 \n    | table \"NoResults\"]"
			},
			"name": "Search_4"
		},
		"ds_SqaTby3h": {
			"type": "ds.search",
			"options": {
				"query": "| stats count by returnCode"
			},
			"name": "Search_5"
		},
		"ds_ljNWYr7J": {
			"type": "ds.search",
			"options": {
				"query": "| mstats avg(\"mx.process.cpu.utilization\") as X WHERE index=\"murex_metrics\" span=10s BY \"mx.env\" | dedup mx.env | table mx.env"
			},
			"name": "search_6"
		}
	},
	"defaults": {
		"dataSources": {
			"ds.search": {
				"options": {
					"queryParameters": {
						"latest": "$global_time.latest$",
						"earliest": "$global_time.earliest$"
					}
				}
			}
		}
	},
	"inputs": {
		"input_H05frgOO": {
			"options": {
				"items": [],
				"token": "host_token",
				"defaultValue": ""
			},
			"title": "HOST",
			"type": "input.dropdown",
			"dataSources": {
				"primary": "ds_ljNWYr7J"
			}
		},
		"input_ricfJKyq": {
			"options": {
				"items": [
					{
						"label": "All",
						"value": "*"
					}
				],
				"defaultValue": "*",
				"token": "dd_mJPWNpbV"
			},
			"title": "Dropdown Input Title",
			"type": "input.dropdown"
		}
	},
	"layout": {
		"type": "absolute",
		"options": {
			"display": "auto-scale"
		},
		"structure": [
			{
				"item": "viz_zmabNRJy",
				"type": "block",
				"position": {
					"x": 300,
					"y": 0,
					"w": 300,
					"h": 250
				}
			},
			{
				"item": "viz_rEigUEIR",
				"type": "block",
				"position": {
					"x": 0,
					"y": 0,
					"w": 300,
					"h": 250
				}
			},
			{
				"item": "viz_AOddcf4l",
				"type": "block",
				"position": {
					"x": 600,
					"y": 0,
					"w": 300,
					"h": 250
				}
			},
			{
				"item": "viz_sAOkMNEW",
				"type": "block",
				"position": {
					"x": 900,
					"y": 0,
					"w": 300,
					"h": 250
				}
			},
			{
				"item": "viz_EvhBsJbp",
				"type": "block",
				"position": {
					"x": 0,
					"y": 250,
					"w": 300,
					"h": 300
				}
			},
			{
				"item": "viz_YSosdreZ",
				"type": "block",
				"position": {
					"x": 300,
					"y": 250,
					"w": 300,
					"h": 300
				}
			},
			{
				"item": "viz_4hVtGw0o",
				"type": "block",
				"position": {
					"x": 600,
					"y": 250,
					"w": 300,
					"h": 300
				}
			},
			{
				"item": "viz_eRVtRn07",
				"type": "block",
				"position": {
					"x": 900,
					"y": 250,
					"w": 300,
					"h": 300
				}
			},
			{
				"item": "viz_KROrPVIl",
				"type": "block",
				"position": {
					"x": 0,
					"y": 550,
					"w": 300,
					"h": 300
				}
			}
		],
		"globalInputs": [
			"input_H05frgOO",
			"input_ricfJKyq"
		]
	},
	"description": "",
	"title": "MX.3 HTTP REQUESTS"
}

 

All I am trying is to change the HOST title to accept dynamic values from a query.

Let me know if this helps you to figure out where I am going wrong.

 

Regards,

Pravin

 

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You no longer have the global_time input which is added when you first created the dashboard in Studio

	"inputs": {
		"input_global_trp": {
			"type": "input.timerange",
			"options": {
				"token": "global_time",
				"defaultValue": "-24h@h,now"
			},
			"title": "Global Time Range"
		}
	},

Consequently, when your defaults section references it

	"defaults": {
		"dataSources": {
			"ds.search": {
				"options": {
					"queryParameters": {
						"latest": "$global_time.latest$",
						"earliest": "$global_time.earliest$"
					}
				}
			}
		}
	},

and you don't override the defaults in your searches, the searches are waiting for this token to be completed (which it never will because you deleted the input)!

Either change or remove the default queryParameters or override them in each search.

_pravin
Communicator

Hi @ITWhisperer ,

 

Thanks for the help.

I added the default global_time input and it worked.

 

Thanks,

Pravin

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In September, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...

Improve Data Pipelines Using Splunk Data Management

  Register Now   This Tech Talk will explore the pipeline management offerings Edge Processor and Ingest ...