Hello everyone. I have a Dropdown token being used as the <valuePrefix> in a Multiselect input. The Multiselect seems to only set the <valuePrefix> tag's value during dashboard initialization. I can get a change in the dropdown to take effect on the Multiselect when refreshing the page in the web browser, but not when changing the Dropdown value or when refreshing the panel. This same behaviour applies to the Checkbox input.  Here is my code for the panel in question:  <panel depends="$Global_Tok$"> <title>CPU</title> <input type="multiselect" token="CPU_Field_Global_Multi"> <label>Fields</label> <choice value="(pctUser) AS User">User</choice> <choice value="(pctIdle) AS Idle">Idle</choice> <choice value="(Load) AS &quot;Load (-Idle)&quot;">Load</choice> <choice value="(pctIowait) AS IO_Wait">IO_Wait</choice> <choice value="(pctNice) AS Nice">Nice</choice> <choice value="(pctSystem) AS System">System</choice> <default>"(Load) AS ""Load (-Idle)""",(pctUser) AS User,(pctIdle) AS Idle,(pctIowait) AS IO_Wait,(pctNice) AS Nice,(pctSystem) AS System</default> <initialValue>(Load) AS "Load (-Idle)",(pctUser) AS User,(pctIdle) AS Idle,(pctIowait) AS IO_Wait,(pctNice) AS Nice,(pctSystem) AS System</initialValue> <valuePrefix>$Global_Function$</valuePrefix> <delimiter> </delimiter> </input> <input type="checkbox" token="CPU_Fields_Cbx"> <label>Fields</label> <choice value="(pctUser) AS User">User</choice> <choice value="(pctIdle) AS Idle">Idle</choice> <choice value="(Load) AS &quot;Load (-Idle)&quot;">Load</choice> <choice value="(pctIowait) AS IO_Wait">IO_Wait</choice> <choice value="(pctNice) AS Nice">Nice</choice> <choice value="(pctSystem) AS System">System</choice> <valuePrefix>$Global_Function$</valuePrefix> </input> <chart> <search> <query>host=$HOST_SELECTION$ source=cpu | multikv | search CPU=$CPU_Core_Global_Tok$ | eval Load=(pctIdle-100)*-1 | timechart span=$Global_Span$ $CPU_Fields_Cbx$</query> <earliest>$Global_Time.earliest$</earliest> <latest>$Global_Time.latest$</latest> <refresh>1m</refresh> <refreshType>delay</refreshType> </search> <option name="charting.axisTitleX.text">Time</option> <option name="charting.axisTitleY.text">CPU Util (%)</option> <option name="charting.axisY.maximumNumber">100</option> <option name="charting.chart">line</option> <option name="charting.drilldown">none</option> <option name="refresh.display">progressbar</option> </chart> </panel> In this example code, the panel is only using the Checkbox input token for the search, but the same issue is applied when I use the Multiselect as well. The token I am updating with the Dropdown input is "$Global_Function$".  The code for the Global Function dropdown input is as follows: <input type="dropdown" token="Global_Function" depends="$Global_Tok$"> <label>Function</label> <choice value="avg">Average</choice> <choice value="max">Maximum</choice> <default>avg</default> <initialValue>avg</initialValue> </input> I have not been able to get the Multiselect or Checkbox inputs to change their initial <valuePrefix> value upon the Function Dropdown changing. So if anyone has suggestions on how to accomplish this, then I am all ears. ... View more

I have two dashboards. The first lower level dashboard has a dropdown to select between multiple hosts of the same type to view diagnostic information among other things. The second higher level dashboard has status indicators which represents the overall "health" of hosts. These status indicators are pre-built panels which are present in both the higher level and lower level dashboards. The status indicators do not have drilldown functionality. As such, my workaround is to use a statistics table under each status indicator which only displays "Click_Here". This works just fine to send the user to the desired dashboard. However, if the user selects the drilldown related to a particular host, I would like that host to be selected in the lower level dashboards dropdown as this will change what panels and status indicators are displayed dynamically. The lower level dashboards dropdown token is used in multiple base searches as well as a number of visualizations. The selection of the dropdown is also used to hide and show panels through a series of <change><condition> tags and tokens. This is an example of my lower level dropdown XML: <input type="dropdown" token="HOST_SELECTION"> <label>Host</label> <choice value="host1">host1</choice> <choice value="host2">host2</choice> <choice value="host3">host3</choice> <default>host1</default> <initialValue>host1</initialValue> <change> <condition label="host1"> <set token="HostType1_Indicator_Tok">true</set> <unset token="HostType2_Indicator_Tok">false</unset> <set token="Host1_Tok">true</set> <unset token="Host2_Tok">false</unset> <unset token="Host3_Tok">false</unset> </condition> Etc... Any input is appreciated. Thank you. ... View more

So here is what I am thinking. In a nutshell, I am looking to have a main dashboard which displays the status of multiple servers as well as display a status indicator for each of them to show the servers current "health". This "health" value would be derived ideally by a secondary dashboard which has multiple status indicators which work in a similar fashion, but are tied to one specific servers sub-systems. I may also incorporate another level that goes into the sub-systems similarly. However, lets just say I am only doing the two levels. I am struggling to find a way to make the second sub-system level dashboards for each server, store and send their health values to the main dashboard so the color of the main dashboards status indicator can be determined for that specific server.  The intent is to have these dashboards on different screens throughout the office but also make following the issues easier. As in you just follow the drilldowns of the indicators showing an issue until you get to a diagnostic dashboard of some sort which can aid in troubleshooting. Some Ideas: Idea One: Have a JavaScript script for each dashboard which uses the Search Heads file structure to communicate between dashboards.  Problems with Idea One: There are many, though I am unsure if I can make the scripts update regularly and communicate while also updating the status indicators on each dashboard at the same time. Also, I am unsure of how to use the search of each of the indicators in a way that will work with the scripts. Even if I make all of this work it may also involve a decent amount of upkeep to keep all the pieces working together. Idea Two: Use Tokens or something similar to share the health values from the lower levels of dashboard up to the Main dashboard. Problems with Idea Two: Put simply I don't know if this is possible. So far as I can tell Tokens are meant to be used as inputs only, can't be changed by search results, and are meant to be sent downstream via drilldowns. Not upstream. Though maybe I could just start at the lowest level of dashboard and create drilldowns that will eventually end up back at the Main dashboard. Though this has its own issues such as needing multiple drilldowns to converge their data onto the same dashboard to get the level of information I would need to calculate an average health of the system.  I am quite open to suggestion. I have spent quite a while brainstorming and attempting to test different ideas to no avail. I am using Splunk Enterprise version 8.1.2. Please let me know if you have any questions. Thank you for taking the time to read this.   ... View more