Splunk Search

Is there a way I can hard-code a drop-down search to display all virtual machines on my network?

idab
Path Finder

Hello people,

Is there a way I can hard-code a drop-down search to display all virtual machines in my network on the drop-down? Without getting the duplicating errors all the time :

Sample of my xml query below:

<form>
  <label>Z_</label>
  <fieldset submitButton="true">
    <input type="dropdown" token="vmname" searchWhenChanged="false">
      <label>host_name</label>
       <query>index=* collection="*" counter=*  collection=LogicalDisk counter="Avg. Disk Queue Length" eventtype=perfmon_logicaldisk  Host="*"  instance=_Total Host=$vmname$  | timechart useother=f minspan=1s avg(Value) AS avg_Disk_Que_Len by host | eval avg_Disk_Que_Len = round(avg_Disk_Que_Len,1) | sort +avg_Disk_Que_Len</query>
0 Karma
1 Solution

MuS
Legend

Hi idab,

I think you mix up something here: you are not hard coding your hosts here, this is a dynamic drop down.
Nevertheless to remove the duplicate error, simply to this in your populating search :

index=* collection="*" counter=*  collection=LogicalDisk counter="Avg. Disk Queue Length" eventtype=perfmon_logicaldisk  Host="*"  | dedup Host

Hope this helps ...

cheers, MuS

View solution in original post

MuS
Legend

Hi idab,

I think you mix up something here: you are not hard coding your hosts here, this is a dynamic drop down.
Nevertheless to remove the duplicate error, simply to this in your populating search :

index=* collection="*" counter=*  collection=LogicalDisk counter="Avg. Disk Queue Length" eventtype=perfmon_logicaldisk  Host="*"  | dedup Host

Hope this helps ...

cheers, MuS

idab
Path Finder

Hi MuS,

I tried what you mentioned above - it didn't solve the problem.See below a sample of what i did so far

Z_

<input type="dropdown" token="vmname" searchWhenChanged="false">
  <label>host_name</label>
  <search>
    <query>index=main collection="*" counter=*  collection=LogicalDisk  eventtype=perfmon_logicaldisk  Host="*"  | dedup Host</query>
  </search>
  <fieldForLabel>name</fieldForLabel>
  <fieldForValue>name</fieldForValue>
  <choice value="*">All</choice>
  <default>*</default>
</input>
<input type="time" searchWhenChanged="true">
  <label></label>
  <default>
    <earliest>-4h@m</earliest>
    <latest>now</latest>
  </default>
</input>
0 Karma

MuS
Legend

is this the correct field?

<fieldForLabel>name</fieldForLabel>
<fieldForValue>name</fieldForValue>

If so, use this populating search:

index=main collection="*" counter=*  collection=LogicalDisk  eventtype=perfmon_logicaldisk  Host="*"  | dedup name | table name

If this still not works, use the Host field as fieldForLabel and fieldForValue

idab
Path Finder

Thanks..MuS. The host field was the problem.
Good job!

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...