About Chintan_m

Chintan_m · ‎02-09-2022

@niketn , Will this solution update the dropdown UI as well? I am having a similar problem of the 2nd dropdown not refreshing when the selection of 1st dropdown which the 2nd dropdown is dependent on) is changed.

Chintan_m · ‎02-07-2022

Hello @dfoster_splunk , I am facing a similar issue. In my case I am using token defined by one dropdown in an append subsearch of another dropdown. Below is my query for the 2nd dropdown. I have highlighted token usage in orange colour. <query> <![CDATA[index=myaccount_db $environment$ $company_code$ NOT SALESORG="NL20" | fillnull COMPANY_CD,SALESORG value="NULL" | eval COMPANY_CD=case(COMPANY_CD=="NULL" AND match(INVOICE_NUMBER,"INV.*"),"US30",COMPANY_CD=="NULL","US10",1=1,COMPANY_CD) | eval SALESORG=case(SALESORG=="NULL" AND COMPANY_CD="US30","US30",SALESORG=="NULL" AND COMPANY_CD="US10","US11",1=1,SALESORG) | stats count by SALESORG | eval SALESORG_FILTER="SALESORG=\"".SALESORG."\"" | eval description=case(SALESORG=="US10","US10 - United States, TAA Publishing/Legal",SALESORG=="US11","US11 - United States, TAA Software",SALESORG=="US12","US12 - United States, Legal",SALESORG=="AU10","AU10 - Australia, Tax and Accounting",SALESORG=="WKFS","WKFS - Compliance Services",SALESORG=="NL20","NL20 - KLI - Netherlands",SALESORG=="NZ10","NZ10 - New Zealand, Tax and Accounting",SALESORG=="US30","US30 - United States, Professional") | stats dc(SALESORG) as ALL values(SALESORG_FILTER) as SALESORG_FILTER1 | eval description=if(ALL > 1,"ALL","NO") | search description="ALL" | eval SALESORG_FILTER = mvjoin(SALESORG_FILTER1, " OR ") | append [ search index=myaccount_db "$environment$" "$company_code$" NOT SALESORG="NL20" | fillnull COMPANY_CD,SALESORG value="NULL" | eval COMPANY_CD=case(COMPANY_CD=="NULL" AND match(INVOICE_NUMBER,"INV.*"),"US30",COMPANY_CD=="NULL","US10",1=1,COMPANY_CD) | eval SALESORG=case(SALESORG=="NULL" AND COMPANY_CD="US30","US30",SALESORG=="NULL" AND COMPANY_CD="US10","US11",1=1,SALESORG) | stats count by SALESORG | eval SALESORG_FILTER="SALESORG=\"".SALESORG."\"" | eval description=case(SALESORG=="US10","US10 - United States, TAA Publishing/Legal",SALESORG=="US11","US11 - United States, TAA Software",SALESORG=="US12","US12 - United States, Legal",SALESORG=="AU10","AU10 - Australia, Tax and Accounting",SALESORG=="WKFS","WKFS - Compliance Services",SALESORG=="NL20","NL20 - KLI - Netherlands",SALESORG=="NZ10","NZ10 - New Zealand, Tax and Accounting",SALESORG=="US30","US30 - United States, Professional") ] | sort description]]> </query>

Chintan_m · ‎03-15-2021

Yes, it works as you anticipated. But the non reflection of changes to UI is still a problem. Thank you so much!

Chintan_m · ‎03-15-2021

I have a dashboard with multiple panels each requiring their separate time inputs. But, the dashboard also needs a common time input. So, the requirements are When the dashboard loads, every panel should have the same time range i.e., default time range of the common time range picker. If the time range picker is changed for a specific panel is changed then it should override the common time range and run only the specified panel again for the new time range. If the common time range picker is changed, it should override the panel specific time ranges and every panel should run again. Basically, the latest changes should override the previous state always. The only catch is that when a panel specific change occurs it only affects that specific panel but when a change us made to common time range picker it will affect all the panels. Here is the Dashboard XML that I am currently using but its's not giving me what I need. <form> <label>EDTC Reporting</label> <description>EDTC requirements for new application</description> <fieldset submitButton="false" autoRun="true"> <input type="time" token="field1" searchWhenChanged="true"> <label></label> <default> <earliest>0</earliest> <latest>now</latest> </default> </input> </fieldset> <row> <panel> <input type="time" token="time1" searchWhenChanged="true"> <label></label> <default> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> </default> </input> <chart> <title>Average Response Time per Module</title> <search> <query>index=main | rex field=processingTime "\[(?<responseTime>\d*)" | stats avg(responseTime) by module</query> <earliest>$time1.earliest$</earliest> <latest>$time1.latest$</latest> </search> <option name="charting.axisTitleX.text">Module</option> <option name="charting.axisTitleY.text">Average Response Time</option> <option name="charting.axisY.scale">linear</option> <option name="charting.chart">column</option> <option name="charting.chart.stackMode">default</option> <option name="charting.drilldown">none</option> </chart> </panel> </row> <row> <panel> <input type="time" token="time2" searchWhenChanged="true"> <label></label> <default> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> </default> </input> <chart> <title>Module wise Error Rate</title> <search> <query>index=main | where isnotnull(errorCode) | stats count as count2 by module | join type=inner module [ search index=main | stats count as count1 by module ] | eval errorRate = (count2/count1*100) | table module errorRate</query> <earliest>$time2.earliest$</earliest> <latest>$time2.latest$</latest> </search> <option name="charting.axisTitleY.text">Error Rate</option> <option name="charting.axisY.maximumNumber">100</option> <option name="charting.axisY.minimumNumber">0</option> <option name="charting.chart">column</option> <option name="charting.drilldown">none</option> <option name="refresh.display">progressbar</option> </chart> </panel> </row> <row> <panel> <input type="time" token="time3" searchWhenChanged="true"> <label></label> <default> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> </default> </input> <chart> <title>Module wise Security Exceptions</title> <search> <query>index=main | where match(displayMessage,"Resource Unavailable") | stats count by module</query> <earliest>$time3.earliest$</earliest> <latest>$time3.latest$</latest> </search> <option name="charting.chart">column</option> <option name="charting.drilldown">none</option> </chart> </panel> </row> <row> <panel> <input type="time" token="time4" searchWhenChanged="true"> <label></label> <default> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> </default> </input> <table> <title>Unique Users</title> <search> <query>index=main | dedup unique_name | table unique_name</query> <earliest>$time4.earliest$</earliest> <latest>$time4.latest$</latest> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> </row> <row> <panel> <input type="time" token="time5" searchWhenChanged="true"> <label></label> <default> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> </default> </input> <table> <title>Most Used Features</title> <search> <query>index=main | dedup _raw | top limit=10 path</query> <earliest>$time5.earliest$</earliest> <latest>$time5.latest$</latest> </search> <option name="drilldown">none</option> </table> </panel> </row> <row> <panel> <input type="time" token="time6" searchWhenChanged="true"> <label></label> <default> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> </default> </input> <table> <title>Least Used Feature</title> <search> <query>index=main | dedup _raw | rare limit=10 path</query> <earliest>$time6.earliest$</earliest> <latest>$time6.latest$</latest> </search> <option name="drilldown">none</option> </table> </panel> </row> </form> And, below shown is what I get when I first open the dashboard.

Posts	4
Solutions	0
Karma Given	1
Karma Received	0
Member Since	‎03-15-2021

Online Status	Offline
Date Last Visited	‎02-09-2022 03:59 AM

Time Input Dependence in a Dashboard

Re: Why is my dynamic dropdown not updating using ...

Re: Can subsearches access search tokens?

Re: Time Input Dependence in a Dashboard

Time Input Dependence in a Dashboard