Splunk Search
×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question

submit button not working

nithys
Communicator
‎03-22-2025 11:16 AM

Hi 

Submit button is not working
1.First time when i load the dashboard ,i select data Data Entity from dropdown and hit submit button .It works and fetch the result of that selecte Data Entity
2.Second time from dropdown selected the another entity without hitting submit button .the search started running for the selected drop down and gets the result.Help needed to fix it
3.In choice Value field "*-test-target" or *-test-product" wanted to be auto populate test or prod based on Env ($stageToken$)

      <label>Data Entity</label>

      <choice value=“name,0”>name</choice>

      <choice value="targetProduct,*-test-target">Target </choice>

      <choice value="product,*-test-product">Product </choice>

<form version="1.1" theme="dark" submitButton="true">
  <label>Stats</label>
  <fieldset>
    <input type="dropdown" token="indexToken1" searchWhenChanged="false">
      <label>Environment</label>
      <choice value="prod,prod">PROD</choice>
      <choice value="np,test">TEST</choice>
      <change>
        <eval token="stageToken">mvindex(split($value$,","),1)</eval>
        <eval token="indexToken">mvindex(split($value$,","),0)</eval>
      </change>
      <default>np,test</default>
    </input>
    <input type="dropdown" token="entityToken" searchWhenChanged="false">
      <label>Data Entity</label>
      <choice value=“name,0”>name</choice>
      <choice value="targetProduct,*-test-target">Target </choice>
      <choice value="product,*-test-product">Product </choice>
      <choice value=“address,0”>address</choice>
      <change>
        <!-- Split the value and set tokens for both parts -->
        <set token="entityLabel">$label$</set>
        <eval token="searchName">mvindex(split($value$, ","),1)</eval>
        <eval token="entityTokenFirst">mvindex(split($value$, ","),0)</eval>
      </change>
    </input>
    <input type="time" token="timeToken" searchWhenChanged="false">
      <label>Time</label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>Distinct Consumer Count</title>
      <single>
        <search>
          <query>index="np" source="**" 
| spath path=$stageToken$.nsp3s{} output=nsp3s
| mvexpand nsp3s
| spath input=nsp3s path=Name output=Name
| spath input=nsp3s path=DistinctAdminUserCount output=DistinctAdminUserCount
| search Name=$searchName$
| sort -_time
| head 1
| appendpipe
    [ stats count
      | eval Name=if(count==0 OR isnull("$searchName$") OR "$searchName$"=="", "No NSP", "$searchName$")
      | fields DistinctAdminUserCount
    ]</query>
          <earliest>$timeToken.earliest$</earliest>
          <latest>$timeToken.latest$</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </single>
    </panel>
    <panel>
      <title>Event Processed</title>
      <single>
        <search>
          <query>index="$indexToken$" source="publish-$entityTokenFirst$-$stageToken$-nsp" 
* Published to NSP3 objectType* | stats count</query>
          <earliest>$timeToken.earliest$</earliest>
          <latest>$timeToken.latest$</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </single>
    </panel>

  </row>
  <row>
    <panel>
      <title>Total Request :</title>
      <single>
        <search>
          <query>index=$indexToken$  source IN ("/aws/lambda/api-data-$stageToken$-$entityTokenFirst$") msg="data:invoke" | stats count</query>
          <earliest>$timeToken.earliest$</earliest>
          <latest>$timeToken.latest$</latest>
          <refresh>60m</refresh>
          <refreshType>delay</refreshType>
        </search>
        <option name="colorMode">none</option>
        <option name="drilldown">none</option>
        <option name="height">317</option>
        <option name="rangeColors">["0xcba700","0xdc4e41"]</option>
        <option name="rangeValues">[200]</option>
        <option name="refresh.display">progressbar</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.size">large</option>
        <option name="unitPosition">after</option>
        <option name="useColors">1</option>
      </single>
    </panel>
  
  </row>
</form>


 

Labels (2)
Labels
0 Karma
Reply

catdadof3
Explorer
‎03-22-2025 04:59 PM

I may be wrong, but I don't think the submit button will work in the form section. I think you'd want it in the fieldset like this:

<fieldset submitButton="true" autoRun="false">

For #3 - I'm not 100% sure what you're asking, but I think you mean that you'd want "*-test-target" and "*-test-product" if test is selected from environment and "*-prod-target"/ "*-prod-product" if prod is selected?

You can add conditions to change based on environment and use a base search to populate it. However, FYI this dropdown won't populate until after you hit submit if you leave the drop down in the fieldset with the submit button.

  <search id="token_base">
    <query>
| makeresults
| eval token_name="name,address,ALL,Target,Product"
| eval token_name=split(token_name, ",")
| stats count by token_name
| fields - count
| eval token_value=CASE(token_name="name", "name,0", token_name="address", "address,0", token_name="ALL", "ALL", token_name="Target", "$target_tok$", token_name="Product", "$product_tok$")
    </query>
  </search>
  <fieldset submitButton="true" autoRun="false">
    <input type="dropdown" token="indexToken1" searchWhenChanged="false">
      <label>Environment</label>
      <choice value="prod,prod">PROD</choice>
      <choice value="np,test">TEST</choice>
      <change>
        <condition value="prod,prod">
          <set token="target_tok">*-prod-target</set>
          <set token="product_tok">*-prod-product</set>
          <eval token="stageToken">mvindex(split($value$,","),1)</eval>
          <eval token="indexToken">mvindex(split($value$,","),0)</eval>
        </condition>
        <condition value="np,test">
          <set token="target_tok">*-test-target</set>
          <set token="product_tok">*-test-product</set>
          <eval token="stageToken">mvindex(split($value$,","),1)</eval>
          <eval token="indexToken">mvindex(split($value$,","),0)</eval>
        </condition>
      </change>
      <default>np,test</default>
    </input>
    <input type="dropdown" token="entityToken" searchWhenChanged="false">
      <label>Data Entity</label>
      <choice value="name,0">name</choice>
      <choice value="targetProduct,*-test-target">Target</choice>
      <choice value="product,*-test-product">Product</choice>
      <choice value="address,0">address</choice>
      <choice value="ALL">ALL</choice>
      <change>
        <condition value="ALL">
          <set token="entityTokenFirst">*</set>
        </condition>
        <condition>
          <!-- Split the value and set tokens for both parts -->
          <set token="entityLabel">$label$</set>
          <eval token="searchName">mvindex(split($value$, ","),1)</eval>
          <eval token="entityTokenFirst">mvindex(split($value$, ","),0)</eval>
        </condition>
      </change>
    </input>
    <input type="dropdown" token="example_tok">
      <label>Example dynamic dropdown</label>
      <search base="token_base">
        <query/>
      </search>
      <fieldForLabel>token_name</fieldForLabel>
      <fieldForValue>token_value</fieldForValue>
    </input>
    <input type="time" token="timeToken" searchWhenChanged="false">
      <label>Time</label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>



 

0 Karma
Reply

nithys
Communicator
‎03-29-2025 07:54 AM

Hi I tried with fieldset in the form ..but its still fetch result based on first dropdown and runs the result



Current Behavior:

  • The dashboard fetches results immediately when the "env" dropdown is selected (e.g., "test" or "prod").
  • Results are fetched without considering other filters like "data entity" or "time."

 Expected behaviour

The dashboard should wait for the user to:

Select a value from the "env" dropdown (e.g., "test" or "prod").

Select a value from the "data entity" dropdown.

Specify a time range.

Only after all selections are made and the "Submit" button is clicked, the query should execute and fetch results.
Could someone help on this .I tried adding fieldset

 

 

<form version="1.1" theme="dark">
  <label>Metrics222</label>
  <fieldset>
    <input type="dropdown" token="indexToken1" searchWhenChanged="false">
      <label>Environment</label>
      <choice value="prod-,prod,*">PROD</choice>
      <choice value="np-,test,*">TEST</choice>
      <change>
        <eval token="stageToken">mvindex(split($value$,","),1)</eval>
        <eval token="indexToken">mvindex(split($value$,","),0)</eval>
     
      </change>
    
    </input>
    <input type="dropdown" token="entityToken" searchWhenChanged="false">
      <label>Data Entity</label>
      <choice value="*">ALL</choice>
    </input>
    <input type="time" token="timeToken" searchWhenChanged="false">
      <label>Time</label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <html id="APIStats">
          <style>
          #user{
          text-align:center;
          color:#BFFF00;
          }
          </style>
        <h2 id="user">API USAGE STATISTICS</h2>
        </html>
    </panel>
  </row>
  <row>
    <panel>
      <table>
        <title>Unique User / Unique Client</title>
        <search>
          <query>index=$indexToken$ AND source="/aws/lambda/g-lambda-au-$stageToken$"  
| stats dc(claims.sub) as "Unique Users", dc(claims.cid) as "Unique Clients" BY claims.cid claims.groups{}
| rename claims.cid AS app, claims.groups{} AS groups
| table app "Unique Users" "Unique Clients" groups</query>
          <earliest>$timeToken.earliest$</earliest>
          <latest>$timeToken.latest$</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <html id="nspCounts">
          <style>
          #user{
          text-align:center;
          color:#BFFF00;
          }
          </style>
        <h2 id="user">NSP STREAM STATISTICS</h2>
        </html>
    </panel>
  </row>
  <row>
    <panel>
      <table>
        <title>Unique Consumer</title>
        <search>
          <query>index="np" source="**"
| spath path=$stageToken$.nsp3s{} output=nsp3s
| sort -_time
| head 1
| mvexpand nsp3s
| spath input=nsp3s path=Name output=Name
| spath input=nsp3s path=DistinctAdminUserCount output=DistinctAdminUserCount
| search Name="*costing*"
| table Name, DistinctAdminUserCount</query>
          <earliest>$timeToken.earliest$</earliest>
          <latest>$timeToken.latest$</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
    <panel>
      <table>
        <title>Event Processed</title>
        <search>
          <query>index="$indexToken$" source="/aws/lambda/publish-$entityToken$-$stageToken$-nsp" "success Published to NSP3 objectType*"
| rex field=msg "objectType\s*:\s*(?&lt;objectType&gt;[^\s]+)" 
| stats count by objectType</query>
          <earliest>$timeToken.earliest$</earliest>
          <latest>$timeToken.latest$</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
    <panel>
      <table>
        <title>Number of Errors</title>
        <search>
          <query>index="$indexToken$" source="/aws/lambda/publish-$entityToken$-$stageToken$-nsp" 
"error*" | stats count</query>
          <earliest>$timeToken.earliest$</earliest>
          <latest>$timeToken.latest$</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <title>API : Data/Search Count</title>
      <html id="errorcount5">
          <style>
          #user{
          text-align:center;
          color:#BFFF00;
          }
          </style>
        <h2 id="user"> API COUNT STATISTICS</h2>
        </html>
    </panel>
  </row>
  <row>
    <panel>
      <title>Total Request Data</title>
      <table>
        <search>
          <query>(index=$indexToken$  source="/aws/lambda/api-data-$stageToken$-$entityToken$" OR source="/aws/lambda/api-commands-$stageToken$-*") ge:*:init:*:invoke
| spath path=event.path output=path
| spath path=event.httpMethod output=http
| eval Path=http + " " + path
|stats count by Path</query>
          <earliest>$timeToken.earliest$</earliest>
          <latest>$timeToken.latest$</latest>
          <refresh>60m</refresh>
          <refreshType>delay</refreshType>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
    <panel>
      <title>Total Request Search</title>
      <table>
        <search>rliest&gt;<query>index=$indexToken$    source IN ("/aws/lambda/api-search-$stageToken$-$entityToken$")   ge:init:*:invoke
| spath path=path output=path
| spath path=httpMethod output=http
| eval Path=http + " " + path
|stats count by Path</query>
          <earliest>$timeToken.earliest$</earliest>
          <latest>$timeToken.latest$</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
    <panel>
      <title>Total Error Count :</title>
      <table>
        <search>rliest&gt;<query>index=$indexToken$    source IN ("/aws/lambda/api-search-$stageToken$-$entityToken$") msg="error*"
(error.status=4* OR error.status=5*)
| eval status=case(like(error.status, "4%"), "4xx", like(error.status, "5%"), "5xx") | stats count by error.status</query>
          <earliest>$timeToken.earliest$</earliest>
          <latest>$timeToken.latest$</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
    <panel>
      <title>Response Time Count in ms</title>
      <table>
        <search>rliest&gt;<query>index=np-papi source IN ("/aws/lambda/api-search-test-*") "ge:init:search:response"
| stats sum(responseTime) as TotalResponseTime, avg(responseTime) as AvgResponseTime
| eval API="Search API"
| eval TotalResponseTime = TotalResponseTime . " ms"
| eval AvgResponseTime = round(AvgResponseTime, 2) . " ms"
| table API, TotalResponseTime, AvgResponseTime
| append [
    search index=np-papi source IN ("/aws/lambda/api-data-test-*") msg="ge:init:data:*"
    | stats sum(responseTime) as TotalResponseTime, avg(responseTime) as AvgResponseTime
    | eval API="DATA API"
    | eval TotalResponseTime = TotalResponseTime . " ms"
    | eval AvgResponseTime = round(AvgResponseTime, 2) . " ms"
    | table API, TotalResponseTime, AvgResponseTime
]
| table API, TotalResponseTime, AvgResponseTime</query>
          <earliest>$timeToken.earliest$</earliest>
          <latest>$timeToken.latest$</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <html id="errorcount16">
          <style>
          #user{
          text-align:center;
          color:#BFFF00;
          }
          </style>
        <h2 id="user">Request per min</h2>
        </html>
    </panel>
  </row>
  <row>
    <panel>
      <table>
        <search>
          <query>index=$indexToken$    source IN ("/aws/lambda/api-data-$stageToken$-$entityToken$","/aws/lambda/api-search-$stageToken$-$entityToken$") "ge:init:*:*"
| timechart span=1m count by source
| untable _time source count
| stats sum(count) as TotalCount, avg(count) as AvgCountPerMin by source
| eval AvgCountPerMin = round(AvgCountPerMin, 2)
| eval source = if(match(source, "api-data-test-(.*)"), replace(source, "/api-data-test-(.*)", "data-\\1"), 
                   if(match(source, "/aws/lambda/api-data-prod-(.*)"), replace(source, "/aws/lambda/api-data-prod-(.*)", "data-\\1"), 
                   if(match(source, "/aws/lambda/api-search-test-(.*)"), replace(source, "/aws/lambda/api-search-test-(.*)", "search-\\1"), 
                   replace(source, "/aws/lambdaapi-search-prod-(.*)", "search-\\1"))))
| table source, TotalCount, AvgCountPerMin</query>
          <earliest>$timeToken.earliest$</earliest>
          <latest>$timeToken.latest$</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <title>SLA % :DATA API</title>
      <table>
        <search>
          <query>index=$indexToken$    source IN ("/aws/lambdaapi-data-$stageToken$-$entityToken$")  "ge:init:data:responseTime"
| eval SLA_threshold = 113 
| eval SLA_compliant = if(responseTime &lt;= SLA_threshold, 1, 0)
| stats count as totalRequests, sum(SLA_compliant) as SLA_passed by source
| eval SLA_percentage = round((SLA_passed / totalRequests) * 100, 2)
| eval API = "DATA API"

| table source, SLA_percentage, totalRequests, SLA_passed</query>
          <earliest>$timeToken.earliest$</earliest>
          <latest>$timeToken.latest$</latest>
          <refresh>60m</refresh>
          <refreshType>delay</refreshType>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
    <panel>
      <title>SLA % :SEARCH API</title>
      <table>
        <search>
          <query>index=$indexToken$    source IN ("/aws/lambda/api-search-$stageToken$-$entityToken$") "ge:init:search:response:time"
| eval SLA_threshold = 100 
| eval SLA_compliant = if(responseTime &lt;= SLA_threshold, 1, 0)
| stats count as totalRequests, sum(SLA_compliant) as SLA_passed by source
| eval SLA_percentage = round((SLA_passed / totalRequests) * 100, 2)
| eval API = "SEARCH API"
| eval source = if(match(source, "/aws/lambda/api-search-test-(.*)"), replace(source, "/aws/lambda\api-search-test-(.*)", "search-\\1"), replace(source, "/aws/lambda/api-search-prod-(.*)", "search-\\1"))
| table source, SLA_percentage, totalRequests, SLA_passed</query>
          <earliest>$timeToken.earliest$</earliest>
          <latest>$timeToken.latest$</latest>
          <refresh>60m</refresh>
          <refreshType>delay</refreshType>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</form>

 

 

 

0 Karma
Reply

catdadof3
Explorer
‎03-29-2025 08:40 AM

Hi - you did not add the options to the fieldset as posted above. You just wrapped the input in fieldset.

Try adding the two additional options like this:

<fieldset submitButton="true" autoRun="false">

 

See the full dashboard:

<form version="1.1" theme="dark">
  <label>Metrics222</label>
  <fieldset submitButton="true" autoRun="false">
    <input type="dropdown" token="indexToken1" searchWhenChanged="false">
      <label>Environment</label>
      <choice value="prod-,prod,*">PROD</choice>
      <choice value="np-,test,*">TEST</choice>
      <change>
        <eval token="stageToken">mvindex(split($value$,","),1)</eval>
        <eval token="indexToken">mvindex(split($value$,","),0)</eval>
     
      </change>
    
    </input>
    <input type="dropdown" token="entityToken" searchWhenChanged="false">
      <label>Data Entity</label>
      <choice value="*">ALL</choice>
    </input>
    <input type="time" token="timeToken" searchWhenChanged="false">
      <label>Time</label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <html id="APIStats">
          <style>
          #user{
          text-align:center;
          color:#BFFF00;
          }
          </style>
        <h2 id="user">API USAGE STATISTICS</h2>
        </html>
    </panel>
  </row>
  <row>
    <panel>
      <table>
        <title>Unique User / Unique Client</title>
        <search>
          <query>index=$indexToken$ AND source="/aws/lambda/g-lambda-au-$stageToken$"  
| stats dc(claims.sub) as "Unique Users", dc(claims.cid) as "Unique Clients" BY claims.cid claims.groups{}
| rename claims.cid AS app, claims.groups{} AS groups
| table app "Unique Users" "Unique Clients" groups</query>
          <earliest>$timeToken.earliest$</earliest>
          <latest>$timeToken.latest$</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <html id="nspCounts">
          <style>
          #user{
          text-align:center;
          color:#BFFF00;
          }
          </style>
        <h2 id="user">NSP STREAM STATISTICS</h2>
        </html>
    </panel>
  </row>
  <row>
    <panel>
      <table>
        <title>Unique Consumer</title>
        <search>
          <query>index="np" source="**"
| spath path=$stageToken$.nsp3s{} output=nsp3s
| sort -_time
| head 1
| mvexpand nsp3s
| spath input=nsp3s path=Name output=Name
| spath input=nsp3s path=DistinctAdminUserCount output=DistinctAdminUserCount
| search Name="*costing*"
| table Name, DistinctAdminUserCount</query>
          <earliest>$timeToken.earliest$</earliest>
          <latest>$timeToken.latest$</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
    <panel>
      <table>
        <title>Event Processed</title>
        <search>
          <query>index="$indexToken$" source="/aws/lambda/publish-$entityToken$-$stageToken$-nsp" "success Published to NSP3 objectType*"
| rex field=msg "objectType\s*:\s*(?&lt;objectType&gt;[^\s]+)" 
| stats count by objectType</query>
          <earliest>$timeToken.earliest$</earliest>
          <latest>$timeToken.latest$</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
    <panel>
      <table>
        <title>Number of Errors</title>
        <search>
          <query>index="$indexToken$" source="/aws/lambda/publish-$entityToken$-$stageToken$-nsp" 
"error*" | stats count</query>
          <earliest>$timeToken.earliest$</earliest>
          <latest>$timeToken.latest$</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <title>API : Data/Search Count</title>
      <html id="errorcount5">
          <style>
          #user{
          text-align:center;
          color:#BFFF00;
          }
          </style>
        <h2 id="user"> API COUNT STATISTICS</h2>
        </html>
    </panel>
  </row>
  <row>
    <panel>
      <title>Total Request Data</title>
      <table>
        <search>
          <query>(index=$indexToken$  source="/aws/lambda/api-data-$stageToken$-$entityToken$" OR source="/aws/lambda/api-commands-$stageToken$-*") ge:*:init:*:invoke
| spath path=event.path output=path
| spath path=event.httpMethod output=http
| eval Path=http + " " + path
|stats count by Path</query>
          <earliest>$timeToken.earliest$</earliest>
          <latest>$timeToken.latest$</latest>
          <refresh>60m</refresh>
          <refreshType>delay</refreshType>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
    <panel>
      <title>Total Request Search</title>
      <table>
        <search>rliest&gt;<query>index=$indexToken$    source IN ("/aws/lambda/api-search-$stageToken$-$entityToken$")   ge:init:*:invoke
| spath path=path output=path
| spath path=httpMethod output=http
| eval Path=http + " " + path
|stats count by Path</query>
          <earliest>$timeToken.earliest$</earliest>
          <latest>$timeToken.latest$</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
    <panel>
      <title>Total Error Count :</title>
      <table>
        <search>rliest&gt;<query>index=$indexToken$    source IN ("/aws/lambda/api-search-$stageToken$-$entityToken$") msg="error*"
(error.status=4* OR error.status=5*)
| eval status=case(like(error.status, "4%"), "4xx", like(error.status, "5%"), "5xx") | stats count by error.status</query>
          <earliest>$timeToken.earliest$</earliest>
          <latest>$timeToken.latest$</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
    <panel>
      <title>Response Time Count in ms</title>
      <table>
        <search>rliest&gt;<query>index=np-papi source IN ("/aws/lambda/api-search-test-*") "ge:init:search:response"
| stats sum(responseTime) as TotalResponseTime, avg(responseTime) as AvgResponseTime
| eval API="Search API"
| eval TotalResponseTime = TotalResponseTime . " ms"
| eval AvgResponseTime = round(AvgResponseTime, 2) . " ms"
| table API, TotalResponseTime, AvgResponseTime
| append [
    search index=np-papi source IN ("/aws/lambda/api-data-test-*") msg="ge:init:data:*"
    | stats sum(responseTime) as TotalResponseTime, avg(responseTime) as AvgResponseTime
    | eval API="DATA API"
    | eval TotalResponseTime = TotalResponseTime . " ms"
    | eval AvgResponseTime = round(AvgResponseTime, 2) . " ms"
    | table API, TotalResponseTime, AvgResponseTime
]
| table API, TotalResponseTime, AvgResponseTime</query>
          <earliest>$timeToken.earliest$</earliest>
          <latest>$timeToken.latest$</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <html id="errorcount16">
          <style>
          #user{
          text-align:center;
          color:#BFFF00;
          }
          </style>
        <h2 id="user">Request per min</h2>
        </html>
    </panel>
  </row>
  <row>
    <panel>
      <table>
        <search>
          <query>index=$indexToken$    source IN ("/aws/lambda/api-data-$stageToken$-$entityToken$","/aws/lambda/api-search-$stageToken$-$entityToken$") "ge:init:*:*"
| timechart span=1m count by source
| untable _time source count
| stats sum(count) as TotalCount, avg(count) as AvgCountPerMin by source
| eval AvgCountPerMin = round(AvgCountPerMin, 2)
| eval source = if(match(source, "api-data-test-(.*)"), replace(source, "/api-data-test-(.*)", "data-\\1"), 
                   if(match(source, "/aws/lambda/api-data-prod-(.*)"), replace(source, "/aws/lambda/api-data-prod-(.*)", "data-\\1"), 
                   if(match(source, "/aws/lambda/api-search-test-(.*)"), replace(source, "/aws/lambda/api-search-test-(.*)", "search-\\1"), 
                   replace(source, "/aws/lambdaapi-search-prod-(.*)", "search-\\1"))))
| table source, TotalCount, AvgCountPerMin</query>
          <earliest>$timeToken.earliest$</earliest>
          <latest>$timeToken.latest$</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <title>SLA % :DATA API</title>
      <table>
        <search>
          <query>index=$indexToken$    source IN ("/aws/lambdaapi-data-$stageToken$-$entityToken$")  "ge:init:data:responseTime"
| eval SLA_threshold = 113 
| eval SLA_compliant = if(responseTime &lt;= SLA_threshold, 1, 0)
| stats count as totalRequests, sum(SLA_compliant) as SLA_passed by source
| eval SLA_percentage = round((SLA_passed / totalRequests) * 100, 2)
| eval API = "DATA API"

| table source, SLA_percentage, totalRequests, SLA_passed</query>
          <earliest>$timeToken.earliest$</earliest>
          <latest>$timeToken.latest$</latest>
          <refresh>60m</refresh>
          <refreshType>delay</refreshType>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
    <panel>
      <title>SLA % :SEARCH API</title>
      <table>
        <search>
          <query>index=$indexToken$    source IN ("/aws/lambda/api-search-$stageToken$-$entityToken$") "ge:init:search:response:time"
| eval SLA_threshold = 100 
| eval SLA_compliant = if(responseTime &lt;= SLA_threshold, 1, 0)
| stats count as totalRequests, sum(SLA_compliant) as SLA_passed by source
| eval SLA_percentage = round((SLA_passed / totalRequests) * 100, 2)
| eval API = "SEARCH API"
| eval source = if(match(source, "/aws/lambda/api-search-test-(.*)"), replace(source, "/aws/lambda\api-search-test-(.*)", "search-\\1"), replace(source, "/aws/lambda/api-search-prod-(.*)", "search-\\1"))
| table source, SLA_percentage, totalRequests, SLA_passed</query>
          <earliest>$timeToken.earliest$</earliest>
          <latest>$timeToken.latest$</latest>
          <refresh>60m</refresh>
          <refreshType>delay</refreshType>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</form>
0 Karma
Reply

nithys
Communicator
‎03-30-2025 04:08 PM

I tried the above dashboard code .
At the first screenshot...no dropdown is selected

 

Screenshot 2025-03-30 at 4.03.15 PM.png

 

Second screenshot :test envis selected and the query started running query for "Unique User/Unique Client) 

The "np-" value to index
source="/aws/lambda/g-lambda-au-test"  "test" is substituted to the query already without selecting data Entity dropdown or time it autoran

Screenshot 2025-03-30 at 4.03.27 PM.png
Screenshot 2025-03-30 at 4.03.43 PM.png

0 Karma
Reply
Get Updates on the Splunk Community!

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...

Splunk Answers Content Calendar, June Edition II

Get ready to dive into Splunk Dashboard panels this week! We'll be tackling common questions around ...

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...
Top