Hi,
Sorry if I am duplicating question here but I could not find an answer in the other posts that matched my scenario.
So I have a number of inputs on my dashboard and two panels, the first panel results in a multi row table. I wish to use the values from one of the fields as an input to a second panel on the same dashboard. I am not sure if this is possible as I have read cases where only single results are passed in this way, is this correct?
Ideally I would like the first query to be complete before the second attempted to load, and I would like the data from the query1 field I am interested in like this ( val1 OR val2 .....), so I can then use a token to insert it into my second query. I've pasted a cut down version of the Dashboard to help where $results_tok_query1$ equates to ( val1 OR val2 .....) resulting form the first query.
Thanks,
N
<form script="refresh_button.js">
<label>Transactions</label>
<description>Filterable means to examine transactions</description>
<fieldset submitButton="true" autoRun="true">
<input type="time" token="global_time_tok">
<label>Time</label>
<default>
<earliest>-4h@m</earliest>
<latest>now</latest>
</default>
</input>
<input type="multiselect" searchWhenChanged="false" token="global_host_tok">
<label>Select Hosts</label>
<prefix>(</prefix>
<suffix>)</suffix>
<valuePrefix>host=</valuePrefix>
<delimiter> OR </delimiter>
<default>host1</default>
<choice value="host1">host1</choice>
<choice value="host2">host2</choice>
..
<choice value="host10">host10</choice>
<initialValue>host1</initialValue>
</input>
<input type="dropdown" token="global_duration_tok">
<label>Completed Transaction Duration (secs)</label>
<choice value="1">>1</choice>
<choice value="5">>5</choice>
<choice value="15">>15</choice>
<choice value="30">>30</choice>
<choice value="60">>60</choice>
<choice value="300">>300</choice>
<choice value="3600">>3600</choice>
<default>15</default>
</input>
<input type="text" token="global_search_tok" searchWhenChanged="false">
<label>Freeform Search</label>
<default> </default>
</input>
</fieldset>
<row>
<panel>
<title>Completed Transactions Info</title>
<table>
<search>
<query>
<my query1 here> |
table _time Host_JVM MemIdNum Interaction Duration |
sort _time
</query>
<earliest>$global_time_tok.earliest$</earliest>
<latest>$global_time_tok.latest$</latest>
</search>
</table>
</panel>
</row>
<row>
<panel>
<title>Completed Transactions Full Log</title>
<event>
<search>
<query>
<my query2 here $results_tok_query1$ |
transaction myCid |
where duration>$global_duration_tok$ | search $global_search_tok$ | sort _time
</query>
<earliest>$global_time_tok.earliest$</earliest>
<latest>$global_time_tok.latest$</latest>
</search>
<option name="type">list</option>
</event>
</panel>
</row>
</form>
Here's the structure that works for me in one dashboard/form.
In the original design, the single search calculated field2 (which was a big chunk of a search) and then ran a map
.
In the revised, two-search form, the first search creates the field2, then the second search runs it.
For whatever reason, this is WAY faster than the map
version, and as a bonus, you can check the details in the index to see of exactly what the final search language was.
The order of the two panels is not important using simple XML. I put the "first" panel at the bottom because, for my use case, I didn't need to see the output, and in my live dash, not reflected below, the panel stays hidden. (If I recall correctly, when using sideview the order would have to be reversed.)
<form>
<fieldset submitButton="true">
....various input fields including the one example here...
<input type="text" token="userfield">
<label>fieldname of user name field</label>
<default>user</default>
</input>
</fieldset>
<row>
<panel depends="$field2$">
<table>
<search>
<query>
search 2 language here $field2$
more search language here
</query>
</search>
</table>
</panel>
</row>
<row>
<panel >
<table>
<search>
<query>
search language here using input field tokens like $userfield$
more search language that calculates and populates field2
| table field2
</query>
<finalized>
<set token="field2">$result.field2$</set>
</finalized>
</search>
</table>
</panel>
</row>
</form>
NOTE - the above is stripped down to the minimum necessary framework to achieve the result. The working parts are the <finalized>
in the first search using the row 1 results to set the token for the second search.
I think what you might want to do is use post processing. This is a little bit of a complex post processing, as they're chained together, but i think it might work for what you're doing.
http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/Viz/Savedsearches#Post-process_searches_2
<form script="refresh_button.js">
<label>Transactions</label>
<description>Filterable means to examine transactions</description>
<fieldset submitButton="true" autoRun="true">
<input type="time" token="global_time_tok">
<label>Time</label>
<default>
<earliest>-4h@m</earliest>
<latest>now</latest>
</default>
</input>
<input type="multiselect" searchWhenChanged="false" token="global_host_tok">
<label>Select Hosts</label>
<prefix>(</prefix>
<suffix>)</suffix>
<valuePrefix>host=</valuePrefix>
<delimiter> OR </delimiter>
<default>host1</default>
<choice value="host1">host1</choice>
<choice value="host2">host2</choice>
..
<choice value="host10">host10</choice>
<initialValue>host1</initialValue>
</input>
<input type="dropdown" token="global_duration_tok">
<label>Completed Transaction Duration (secs)</label>
<choice value="1">>1</choice>
<choice value="5">>5</choice>
<choice value="15">>15</choice>
<choice value="30">>30</choice>
<choice value="60">>60</choice>
<choice value="300">>300</choice>
<choice value="3600">>3600</choice>
<default>15</default>
</input>
<input type="text" token="global_search_tok" searchWhenChanged="false">
<label>Freeform Search</label>
<default> </default>
</input>
</fieldset>
<search id="baseSearch">
<query>
<my query1 here> |
table _time Host_JVM MemIdNum Interaction Duration |
sort _time
</query>
<earliest>$global_time_tok.earliest$</earliest>
<latest>$global_time_tok.latest$</latest>
</search>
<search base="baseSearch" id="subBaseSearch">
<query>
|table interestingField|format
</query>
<earliest>$global_time_tok.earliest$</earliest>
<latest>$global_time_tok.latest$</latest>
<done><set token="results_tok_query1">$results.interestingField$</set></done>
</search>
<row>
<panel>
<title>Completed Transactions Info</title>
<table>
<search base="baseSearch">
<query>
</query>
<earliest>$global_time_tok.earliest$</earliest>
<latest>$global_time_tok.latest$</latest>
</search>
</table>
</panel>
</row>
<row>
<panel>
<title>Completed Transactions Full Log</title>
<event>
<search>
<query>
<my query2 here $results_tok_query1$ |
transaction myCid |
where duration>$global_duration_tok$ | search $global_search_tok$ | sort _time
</query>
<earliest>$global_time_tok.earliest$</earliest>
<latest>$global_time_tok.latest$</latest>
</search>
<option name="type">list</option>
</event>
</panel>
</row>
</form>