About qxu5715

qxu5715 · ‎07-03-2018

I want to build a dashboard with a text input as a filter, that shows all values in a field which are less than XX. I wanna do it with a textbox as input, cause the column includes values between 0 and 1677215. e.g.: If i write 20000 in the textbox, the dashboard should show me all values less (or equal) 20000. I've tried to escape the "<" expression with "& lt;" , but that didn't work (the space between & and l is, of course, not in my sourcode, but just here).

qxu5715 · ‎06-18-2018

Hello Community, I have a general question concerning the running time in a Dashboard. Is there an essential Difference between the running time of a Dashboard with an Inlinesearch or a Savedsearch/Report? I'm still a newbie with Splunk so I've tried to built several Dashboards, some with an Inlinesearch and some with an savedsearch but basically with the same sourcecode and what I've observed is, that the search results come much faster with an Inlinesearch. Is my hypothesis right and if yes can sb. explain why? If not, than my sourcecode is just inefficient and I have to rebuilt it.^^ Thanks and Regards!

qxu5715 · ‎06-11-2018

Worked well, thanks for the support!

qxu5715 · ‎06-11-2018

I want to build a Dashbaord with a savedsearch and a checkbox input with several values (value1,value2,value3...) When I am selecting just one value on the UI, the search works fine, but as soon as I'm selecting several values, it is not working anymore. To be honest I am not sure if the reason is my wrong search query or my wrong use of tokens: <input type="checkbox" token="Token_name" searchWhenChanged="true"> <label>field1</label> <choice value="value1">value1</choice> <choice value="value2">value2</choice> <choice value="value3">value3</choice> <delimiter> OR </delimiter> <search> <query>|savedsearch "saved_Report" |search Value_in_report=$Token_name$</query> </search> I've tried several options of changing the token properties including: Token Prefix -> ( Token Suffix -> ) Token Value Prefix -> Value_in_report=" Token Value Suffix -> " Delimiter -> AND,OR It would be nice, if sb. could explain how the checkbox input is working with several selected values. Thanks and regards

qxu5715 · ‎05-29-2018

@niketn, I've already tried it with a savedsearch, but either nothing happened or the error "Could not find variable in the argument map" occured. I've tried several opportunities like: |savedsearch testsavedsearch |where Value_in_Report=$Token_Name$ |savedsearch testsavedsearch |search Value_in_Report=$Token_Name$ |savedsearch testsavedsearch Value_in_Report=$Token_Name$ Furthermore I've tried it with a report, where the token is also implemented: index=main sourcetype=test Value_in_Report=$Token_Name$ |timechart ....

qxu5715 · ‎05-28-2018

Hello Community, I'm sorry if this question has already been asked, but I'm still a newbie in Splunk so please be gentle with me 🙂 In this case, u can just link the relevant question/answer. I want to build a Dashboard with different Input types, that is generating the results of a report. I already know, that this is quite simple with an inline search, but I want to use the Dashboard explicitly with a report/savedsearch. To sum up: I wanna have a Dashboard, where u can use a text input/radio buttons etc. to let the report know, what it has to search for. The idea is that I wanna build a couple of Reports that are implemented in a few different Dashboards. If I should change sth. in one of those reports, the changes shall affect the Dashboards as well, so that I don't have to make all these changes for every single Dashboard. I hope my problem gets clear. Thanks and Regards

qxu5715 · ‎05-25-2018

Hallo Herr Müller, könnten Sie dieses Beispiel vll etwas näher erläutern bzw. an einem Beispiel veranschaulichen? Ich versuche ähnliches Problem wie oben beschrieben zu lösen, jedoch ohne Erfolg. Gibt es einen Unterschied, wenn man seinen Token mittels $foo$ aufruft oder einen anderen Namen nutzt ($token_name$)? Thx und VG

qxu5715 · ‎05-09-2018

I'm a rookie at splunk and trying to implement a wildcard search via input type text in a dashboard. Unfortunately it seems, that the constellation "Wildcard", "input type="text"" and data type "UINT32" won't work. I've tested the search with other data types and it worked well. Has anybody made same experience with this and even more, has found a way to solve this kinda problem? Please, dont ask why "UINT32" is used, it was a decision made by our company. Thanks so far!

Posts	8
Solutions	0
Karma Given	2
Karma Received	1
Member Since	‎05-09-2018

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

How to generate a "less than" filter in a dashboar...

Running time comparison Inlinesearch vs. Savedsear...

How to select multiple values in a checkbox for a ...

How to build a dashboard with different input type...

Which data type is allowed for using a wildcard?

How to generate a "less than" filter in a dashboar...

Running time comparison Inlinesearch vs. Savedsear...

Re: How to select multiple values in a checkbox fo...

How to select multiple values in a checkbox for a ...

Re: How to build a dashboard with different input ...

How to build a dashboard with different input type...

Re: How to use tokens in a dynamic saved search?

Which data type is allowed for using a wildcard?