Splunk Search

How to get dynamic inputs through a query in Dashboard studio?

_pravin
Communicator

Hi,

I am trying to implement a dynamic input dropdown using a query in the dashboard studio.
The code I am using is as follows:

        "input_H05frgOO": {
            "options": {
                "items": [],
                "token": "host_token",
                "defaultValue": ""
            },
            "title": "HOST",
            "type": "input.dropdown",
            "dataSources": {
                "primary": "ds_ljNWYr7J"
            }
        }

And below is the data sources:

        "ds_ljNWYr7J": {
            "type": "ds.search",
            "options": {
                "query": "| mstats avg(\"mx.process.cpu.utilization\") as X WHERE index=\"murex_metrics\" span=10s BY \"mx.env\" | dedup mx.env | table mx.env"
            },
            "name": "search_6"
        }

The input dropdown says "waiting for input".

Could you please help me with the issue?

 

Regards,
Pravin

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

You no longer have the global_time input which is added when you first created the dashboard in Studio

	"inputs": {
		"input_global_trp": {
			"type": "input.timerange",
			"options": {
				"token": "global_time",
				"defaultValue": "-24h@h,now"
			},
			"title": "Global Time Range"
		}
	},

Consequently, when your defaults section references it

	"defaults": {
		"dataSources": {
			"ds.search": {
				"options": {
					"queryParameters": {
						"latest": "$global_time.latest$",
						"earliest": "$global_time.earliest$"
					}
				}
			}
		}
	},

and you don't override the defaults in your searches, the searches are waiting for this token to be completed (which it never will because you deleted the input)!

Either change or remove the default queryParameters or override them in each search.

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

You don't appear to have any query parameters set for your search so what defaults have you got - perhaps these have been left from when the dashboard was created but the input no longer exists?

 

	"defaults": {
		"dataSources": {
			"ds.search": {
				"options": {
					"queryParameters": {
						"latest": "$global_time.latest$",
						"earliest": "$global_time.earliest$"
					}
				}
			}
		}
	},

 

0 Karma

_pravin
Communicator

Hi @ITWhisperer ,

 

I do have the default dataSources but didn't add them due to the restrictions on the number of characters.

{
	"visualizations": {
		"viz_rEigUEIR": {
			"type": "splunk.singlevalue",
			"options": {},
			"dataSources": {
				"primary": "ds_RsGANSf0"
			}
		},
		"viz_zmabNRJy": {
			"type": "splunk.singlevalue",
			"options": {},
			"dataSources": {
				"primary": "ds_zljEkcGY"
			}
		},
		"viz_AOddcf4l": {
			"type": "splunk.singlevalue",
			"options": {},
			"dataSources": {
				"primary": "ds_EIcGt3S9"
			}
		},
		"viz_sAOkMNEW": {
			"type": "splunk.singlevalue",
			"options": {},
			"dataSources": {
				"primary": "ds_Qac6WE2F"
			}
		},
		"viz_EvhBsJbp": {
			"type": "splunk.column",
			"options": {},
			"dataSources": {
				"primary": "ds_a0sVgSvn"
			}
		},
		"viz_YSosdreZ": {
			"type": "splunk.fillergauge",
			"options": {},
			"dataSources": {
				"primary": "ds_EmopXHob"
			}
		},
		"viz_4hVtGw0o": {
			"type": "splunk.fillergauge",
			"options": {},
			"dataSources": {
				"primary": "ds_by7ATPra"
			}
		},
		"viz_eRVtRn07": {
			"type": "splunk.pie",
			"options": {},
			"dataSources": {
				"primary": "ds_SqaTby3h"
			}
		},
		"viz_KROrPVIl": {
			"type": "splunk.table",
			"options": {}
		}
	},
	"dataSources": {
		"ds_RsGANSf0": {
			"type": "ds.search",
			"options": {
				"query": "|  stats max(requestDurationMs) \n    | appendpipe \n    [ stats count \n    | eval \"NoResults\"=\"No Requests Found\" \n    | where count=0 \n    | table \"NoResults\"]"
			},
			"name": "Max Request Duration"
		},
		"ds_zljEkcGY": {
			"type": "ds.search",
			"options": {
				"query": "| eval NEW_TIME = now() - _time \n| where NEW_TIME < 10 \n| stats count(requestDurationMs) \n| appendpipe \n    [ stats count \n    | eval \"NoResults\"=\"No Requests Found\" \n    | where count=0 \n    | table \"NoResults\"]"
			},
			"name": "Requests in the last 10s"
		},
		"ds_TzAuc20h_ds_RsGANSf0": {
			"type": "ds.search",
			"options": {
				"query": "|  stats max(requestDurationMs) \n    | appendpipe \n    [ stats count \n    | eval \"NoResults\"=\"No Requests Found\" \n    | where count=0 \n    | table \"NoResults\"]"
			},
			"name": "Max Request Duration copy 1"
		},
		"ds_EIcGt3S9": {
			"type": "ds.search",
			"options": {
				"query": "| stats count(requestDurationMs) as count \n| eval count=count \n| appendpipe \n    [| eval \"NoResults\"=\"No Requests Found\" \n    | where count=0 \n    | table \"NoResults\"]"
			},
			"name": "Request Frequency"
		},
		"ds_Qac6WE2F": {
			"type": "ds.search",
			"options": {
				"query": "| search (returnCode=\"4*\" OR returnCode=\"5*\") \n| stats count as failedRequestNb \n| appendpipe \n    [| eval \"NoResults\"=\"No Requests Found\" \n    | where count=0 \n    | table \"NoResults\"]"
			},
			"name": "Search_1"
		},
		"ds_a0sVgSvn": {
			"type": "ds.search",
			"options": {
				"query": "| table _time requestDurationMs"
			},
			"name": "Search_2"
		},
		"ds_EmopXHob": {
			"type": "ds.search",
			"options": {
				"query": "| eval NEW_TIME = now() - _time \n| where NEW_TIME < 10 \n| stats count(requestDurationMs) \n| appendpipe \n    [ stats count \n    | eval \"NoResults\"=\"No Requests Found\" \n    | where count=0 \n    | table \"NoResults\"]"
			},
			"name": "Search_3"
		},
		"ds_by7ATPra": {
			"type": "ds.search",
			"options": {
				"query": "| stats count(requestDurationMs) as count \n| eval count=count \n| appendpipe \n    [| eval \"NoResults\"=\"No Requests Found\" \n    | where count=0 \n    | table \"NoResults\"]"
			},
			"name": "Search_4"
		},
		"ds_SqaTby3h": {
			"type": "ds.search",
			"options": {
				"query": "| stats count by returnCode"
			},
			"name": "Search_5"
		},
		"ds_ljNWYr7J": {
			"type": "ds.search",
			"options": {
				"query": "| mstats avg(\"mx.process.cpu.utilization\") as X WHERE index=\"murex_metrics\" span=10s BY \"mx.env\" | dedup mx.env | table mx.env"
			},
			"name": "search_6"
		}
	},
	"defaults": {
		"dataSources": {
			"ds.search": {
				"options": {
					"queryParameters": {
						"latest": "$global_time.latest$",
						"earliest": "$global_time.earliest$"
					}
				}
			}
		}
	},
	"inputs": {
		"input_H05frgOO": {
			"options": {
				"items": [],
				"token": "host_token",
				"defaultValue": ""
			},
			"title": "HOST",
			"type": "input.dropdown",
			"dataSources": {
				"primary": "ds_ljNWYr7J"
			}
		},
		"input_ricfJKyq": {
			"options": {
				"items": [
					{
						"label": "All",
						"value": "*"
					}
				],
				"defaultValue": "*",
				"token": "dd_mJPWNpbV"
			},
			"title": "Dropdown Input Title",
			"type": "input.dropdown"
		}
	},
	"layout": {
		"type": "absolute",
		"options": {
			"display": "auto-scale"
		},
		"structure": [
			{
				"item": "viz_zmabNRJy",
				"type": "block",
				"position": {
					"x": 300,
					"y": 0,
					"w": 300,
					"h": 250
				}
			},
			{
				"item": "viz_rEigUEIR",
				"type": "block",
				"position": {
					"x": 0,
					"y": 0,
					"w": 300,
					"h": 250
				}
			},
			{
				"item": "viz_AOddcf4l",
				"type": "block",
				"position": {
					"x": 600,
					"y": 0,
					"w": 300,
					"h": 250
				}
			},
			{
				"item": "viz_sAOkMNEW",
				"type": "block",
				"position": {
					"x": 900,
					"y": 0,
					"w": 300,
					"h": 250
				}
			},
			{
				"item": "viz_EvhBsJbp",
				"type": "block",
				"position": {
					"x": 0,
					"y": 250,
					"w": 300,
					"h": 300
				}
			},
			{
				"item": "viz_YSosdreZ",
				"type": "block",
				"position": {
					"x": 300,
					"y": 250,
					"w": 300,
					"h": 300
				}
			},
			{
				"item": "viz_4hVtGw0o",
				"type": "block",
				"position": {
					"x": 600,
					"y": 250,
					"w": 300,
					"h": 300
				}
			},
			{
				"item": "viz_eRVtRn07",
				"type": "block",
				"position": {
					"x": 900,
					"y": 250,
					"w": 300,
					"h": 300
				}
			},
			{
				"item": "viz_KROrPVIl",
				"type": "block",
				"position": {
					"x": 0,
					"y": 550,
					"w": 300,
					"h": 300
				}
			}
		],
		"globalInputs": [
			"input_H05frgOO",
			"input_ricfJKyq"
		]
	},
	"description": "",
	"title": "MX.3 HTTP REQUESTS"
}

 

All I am trying is to change the HOST title to accept dynamic values from a query.

Let me know if this helps you to figure out where I am going wrong.

 

Regards,

Pravin

 

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You no longer have the global_time input which is added when you first created the dashboard in Studio

	"inputs": {
		"input_global_trp": {
			"type": "input.timerange",
			"options": {
				"token": "global_time",
				"defaultValue": "-24h@h,now"
			},
			"title": "Global Time Range"
		}
	},

Consequently, when your defaults section references it

	"defaults": {
		"dataSources": {
			"ds.search": {
				"options": {
					"queryParameters": {
						"latest": "$global_time.latest$",
						"earliest": "$global_time.earliest$"
					}
				}
			}
		}
	},

and you don't override the defaults in your searches, the searches are waiting for this token to be completed (which it never will because you deleted the input)!

Either change or remove the default queryParameters or override them in each search.

_pravin
Communicator

Hi @ITWhisperer ,

 

Thanks for the help.

I added the default global_time input and it worked.

 

Thanks,

Pravin

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...