Splunk Search

How to get dynamic inputs through a query in Dashboard studio?

_pravin
Path Finder

Hi,

I am trying to implement a dynamic input dropdown using a query in the dashboard studio.
The code I am using is as follows:

        "input_H05frgOO": {
            "options": {
                "items": [],
                "token": "host_token",
                "defaultValue": ""
            },
            "title": "HOST",
            "type": "input.dropdown",
            "dataSources": {
                "primary": "ds_ljNWYr7J"
            }
        }

And below is the data sources:

        "ds_ljNWYr7J": {
            "type": "ds.search",
            "options": {
                "query": "| mstats avg(\"mx.process.cpu.utilization\") as X WHERE index=\"murex_metrics\" span=10s BY \"mx.env\" | dedup mx.env | table mx.env"
            },
            "name": "search_6"
        }

The input dropdown says "waiting for input".

Could you please help me with the issue?

 

Regards,
Pravin

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

You no longer have the global_time input which is added when you first created the dashboard in Studio

	"inputs": {
		"input_global_trp": {
			"type": "input.timerange",
			"options": {
				"token": "global_time",
				"defaultValue": "-24h@h,now"
			},
			"title": "Global Time Range"
		}
	},

Consequently, when your defaults section references it

	"defaults": {
		"dataSources": {
			"ds.search": {
				"options": {
					"queryParameters": {
						"latest": "$global_time.latest$",
						"earliest": "$global_time.earliest$"
					}
				}
			}
		}
	},

and you don't override the defaults in your searches, the searches are waiting for this token to be completed (which it never will because you deleted the input)!

Either change or remove the default queryParameters or override them in each search.

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

You don't appear to have any query parameters set for your search so what defaults have you got - perhaps these have been left from when the dashboard was created but the input no longer exists?

 

	"defaults": {
		"dataSources": {
			"ds.search": {
				"options": {
					"queryParameters": {
						"latest": "$global_time.latest$",
						"earliest": "$global_time.earliest$"
					}
				}
			}
		}
	},

 

0 Karma

_pravin
Path Finder

Hi @ITWhisperer ,

 

I do have the default dataSources but didn't add them due to the restrictions on the number of characters.

{
	"visualizations": {
		"viz_rEigUEIR": {
			"type": "splunk.singlevalue",
			"options": {},
			"dataSources": {
				"primary": "ds_RsGANSf0"
			}
		},
		"viz_zmabNRJy": {
			"type": "splunk.singlevalue",
			"options": {},
			"dataSources": {
				"primary": "ds_zljEkcGY"
			}
		},
		"viz_AOddcf4l": {
			"type": "splunk.singlevalue",
			"options": {},
			"dataSources": {
				"primary": "ds_EIcGt3S9"
			}
		},
		"viz_sAOkMNEW": {
			"type": "splunk.singlevalue",
			"options": {},
			"dataSources": {
				"primary": "ds_Qac6WE2F"
			}
		},
		"viz_EvhBsJbp": {
			"type": "splunk.column",
			"options": {},
			"dataSources": {
				"primary": "ds_a0sVgSvn"
			}
		},
		"viz_YSosdreZ": {
			"type": "splunk.fillergauge",
			"options": {},
			"dataSources": {
				"primary": "ds_EmopXHob"
			}
		},
		"viz_4hVtGw0o": {
			"type": "splunk.fillergauge",
			"options": {},
			"dataSources": {
				"primary": "ds_by7ATPra"
			}
		},
		"viz_eRVtRn07": {
			"type": "splunk.pie",
			"options": {},
			"dataSources": {
				"primary": "ds_SqaTby3h"
			}
		},
		"viz_KROrPVIl": {
			"type": "splunk.table",
			"options": {}
		}
	},
	"dataSources": {
		"ds_RsGANSf0": {
			"type": "ds.search",
			"options": {
				"query": "|  stats max(requestDurationMs) \n    | appendpipe \n    [ stats count \n    | eval \"NoResults\"=\"No Requests Found\" \n    | where count=0 \n    | table \"NoResults\"]"
			},
			"name": "Max Request Duration"
		},
		"ds_zljEkcGY": {
			"type": "ds.search",
			"options": {
				"query": "| eval NEW_TIME = now() - _time \n| where NEW_TIME < 10 \n| stats count(requestDurationMs) \n| appendpipe \n    [ stats count \n    | eval \"NoResults\"=\"No Requests Found\" \n    | where count=0 \n    | table \"NoResults\"]"
			},
			"name": "Requests in the last 10s"
		},
		"ds_TzAuc20h_ds_RsGANSf0": {
			"type": "ds.search",
			"options": {
				"query": "|  stats max(requestDurationMs) \n    | appendpipe \n    [ stats count \n    | eval \"NoResults\"=\"No Requests Found\" \n    | where count=0 \n    | table \"NoResults\"]"
			},
			"name": "Max Request Duration copy 1"
		},
		"ds_EIcGt3S9": {
			"type": "ds.search",
			"options": {
				"query": "| stats count(requestDurationMs) as count \n| eval count=count \n| appendpipe \n    [| eval \"NoResults\"=\"No Requests Found\" \n    | where count=0 \n    | table \"NoResults\"]"
			},
			"name": "Request Frequency"
		},
		"ds_Qac6WE2F": {
			"type": "ds.search",
			"options": {
				"query": "| search (returnCode=\"4*\" OR returnCode=\"5*\") \n| stats count as failedRequestNb \n| appendpipe \n    [| eval \"NoResults\"=\"No Requests Found\" \n    | where count=0 \n    | table \"NoResults\"]"
			},
			"name": "Search_1"
		},
		"ds_a0sVgSvn": {
			"type": "ds.search",
			"options": {
				"query": "| table _time requestDurationMs"
			},
			"name": "Search_2"
		},
		"ds_EmopXHob": {
			"type": "ds.search",
			"options": {
				"query": "| eval NEW_TIME = now() - _time \n| where NEW_TIME < 10 \n| stats count(requestDurationMs) \n| appendpipe \n    [ stats count \n    | eval \"NoResults\"=\"No Requests Found\" \n    | where count=0 \n    | table \"NoResults\"]"
			},
			"name": "Search_3"
		},
		"ds_by7ATPra": {
			"type": "ds.search",
			"options": {
				"query": "| stats count(requestDurationMs) as count \n| eval count=count \n| appendpipe \n    [| eval \"NoResults\"=\"No Requests Found\" \n    | where count=0 \n    | table \"NoResults\"]"
			},
			"name": "Search_4"
		},
		"ds_SqaTby3h": {
			"type": "ds.search",
			"options": {
				"query": "| stats count by returnCode"
			},
			"name": "Search_5"
		},
		"ds_ljNWYr7J": {
			"type": "ds.search",
			"options": {
				"query": "| mstats avg(\"mx.process.cpu.utilization\") as X WHERE index=\"murex_metrics\" span=10s BY \"mx.env\" | dedup mx.env | table mx.env"
			},
			"name": "search_6"
		}
	},
	"defaults": {
		"dataSources": {
			"ds.search": {
				"options": {
					"queryParameters": {
						"latest": "$global_time.latest$",
						"earliest": "$global_time.earliest$"
					}
				}
			}
		}
	},
	"inputs": {
		"input_H05frgOO": {
			"options": {
				"items": [],
				"token": "host_token",
				"defaultValue": ""
			},
			"title": "HOST",
			"type": "input.dropdown",
			"dataSources": {
				"primary": "ds_ljNWYr7J"
			}
		},
		"input_ricfJKyq": {
			"options": {
				"items": [
					{
						"label": "All",
						"value": "*"
					}
				],
				"defaultValue": "*",
				"token": "dd_mJPWNpbV"
			},
			"title": "Dropdown Input Title",
			"type": "input.dropdown"
		}
	},
	"layout": {
		"type": "absolute",
		"options": {
			"display": "auto-scale"
		},
		"structure": [
			{
				"item": "viz_zmabNRJy",
				"type": "block",
				"position": {
					"x": 300,
					"y": 0,
					"w": 300,
					"h": 250
				}
			},
			{
				"item": "viz_rEigUEIR",
				"type": "block",
				"position": {
					"x": 0,
					"y": 0,
					"w": 300,
					"h": 250
				}
			},
			{
				"item": "viz_AOddcf4l",
				"type": "block",
				"position": {
					"x": 600,
					"y": 0,
					"w": 300,
					"h": 250
				}
			},
			{
				"item": "viz_sAOkMNEW",
				"type": "block",
				"position": {
					"x": 900,
					"y": 0,
					"w": 300,
					"h": 250
				}
			},
			{
				"item": "viz_EvhBsJbp",
				"type": "block",
				"position": {
					"x": 0,
					"y": 250,
					"w": 300,
					"h": 300
				}
			},
			{
				"item": "viz_YSosdreZ",
				"type": "block",
				"position": {
					"x": 300,
					"y": 250,
					"w": 300,
					"h": 300
				}
			},
			{
				"item": "viz_4hVtGw0o",
				"type": "block",
				"position": {
					"x": 600,
					"y": 250,
					"w": 300,
					"h": 300
				}
			},
			{
				"item": "viz_eRVtRn07",
				"type": "block",
				"position": {
					"x": 900,
					"y": 250,
					"w": 300,
					"h": 300
				}
			},
			{
				"item": "viz_KROrPVIl",
				"type": "block",
				"position": {
					"x": 0,
					"y": 550,
					"w": 300,
					"h": 300
				}
			}
		],
		"globalInputs": [
			"input_H05frgOO",
			"input_ricfJKyq"
		]
	},
	"description": "",
	"title": "MX.3 HTTP REQUESTS"
}

 

All I am trying is to change the HOST title to accept dynamic values from a query.

Let me know if this helps you to figure out where I am going wrong.

 

Regards,

Pravin

 

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You no longer have the global_time input which is added when you first created the dashboard in Studio

	"inputs": {
		"input_global_trp": {
			"type": "input.timerange",
			"options": {
				"token": "global_time",
				"defaultValue": "-24h@h,now"
			},
			"title": "Global Time Range"
		}
	},

Consequently, when your defaults section references it

	"defaults": {
		"dataSources": {
			"ds.search": {
				"options": {
					"queryParameters": {
						"latest": "$global_time.latest$",
						"earliest": "$global_time.earliest$"
					}
				}
			}
		}
	},

and you don't override the defaults in your searches, the searches are waiting for this token to be completed (which it never will because you deleted the input)!

Either change or remove the default queryParameters or override them in each search.

_pravin
Path Finder

Hi @ITWhisperer ,

 

Thanks for the help.

I added the default global_time input and it worked.

 

Thanks,

Pravin

0 Karma
Get Updates on the Splunk Community!

Security Highlights: September 2022 Newsletter

 September 2022 The Splunk App for Fraud Analytics (SFA) is now Splunk SupportedUse your existing Splunk ...

Platform Highlights | September 2022 Newsletter

 September 2022 What’s New in 9.0 and How to UpgradeGet a walk through of what is new Splunk Enterprise 9.0 ...

Observability Highlights | September 2022 Newsletter

 September 2022 Splunk Observability SuiteAccess to "Classic" SignalFx Interface Will be Removed on Sept 30, ...