About catdadof3

catdadof3 · ‎03-29-2025

Hi - you did not add the options to the fieldset as posted above. You just wrapped the input in fieldset. Try adding the two additional options like this: <fieldset submitButton="true" autoRun="false"> See the full dashboard: <form version="1.1" theme="dark"> <label>Metrics222</label> <fieldset submitButton="true" autoRun="false"> <input type="dropdown" token="indexToken1" searchWhenChanged="false"> <label>Environment</label> <choice value="prod-,prod,*">PROD</choice> <choice value="np-,test,*">TEST</choice> <change> <eval token="stageToken">mvindex(split($value$,","),1)</eval> <eval token="indexToken">mvindex(split($value$,","),0)</eval> </change> </input> <input type="dropdown" token="entityToken" searchWhenChanged="false"> <label>Data Entity</label> <choice value="*">ALL</choice> </input> <input type="time" token="timeToken" searchWhenChanged="false"> <label>Time</label> <default> <earliest>-24h@h</earliest> <latest>now</latest> </default> </input> </fieldset> <row> <panel> <html id="APIStats"> <style> #user{ text-align:center; color:#BFFF00; } </style> <h2 id="user">API USAGE STATISTICS</h2> </html> </panel> </row> <row> <panel> <table> <title>Unique User / Unique Client</title> <search> <query>index=$indexToken$ AND source="/aws/lambda/g-lambda-au-$stageToken$" | stats dc(claims.sub) as "Unique Users", dc(claims.cid) as "Unique Clients" BY claims.cid claims.groups{} | rename claims.cid AS app, claims.groups{} AS groups | table app "Unique Users" "Unique Clients" groups</query> <earliest>$timeToken.earliest$</earliest> <latest>$timeToken.latest$</latest> </search> <option name="drilldown">none</option> </table> </panel> </row> <row> <panel> <html id="nspCounts"> <style> #user{ text-align:center; color:#BFFF00; } </style> <h2 id="user">NSP STREAM STATISTICS</h2> </html> </panel> </row> <row> <panel> <table> <title>Unique Consumer</title> <search> <query>index="np" source="**" | spath path=$stageToken$.nsp3s{} output=nsp3s | sort -_time | head 1 | mvexpand nsp3s | spath input=nsp3s path=Name output=Name | spath input=nsp3s path=DistinctAdminUserCount output=DistinctAdminUserCount | search Name="*costing*" | table Name, DistinctAdminUserCount</query> <earliest>$timeToken.earliest$</earliest> <latest>$timeToken.latest$</latest> </search> <option name="drilldown">none</option> </table> </panel> <panel> <table> <title>Event Processed</title> <search> <query>index="$indexToken$" source="/aws/lambda/publish-$entityToken$-$stageToken$-nsp" "success Published to NSP3 objectType*" | rex field=msg "objectType\s*:\s*(?<objectType>[^\s]+)" | stats count by objectType</query> <earliest>$timeToken.earliest$</earliest> <latest>$timeToken.latest$</latest> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> <panel> <table> <title>Number of Errors</title> <search> <query>index="$indexToken$" source="/aws/lambda/publish-$entityToken$-$stageToken$-nsp" "error*" | stats count</query> <earliest>$timeToken.earliest$</earliest> <latest>$timeToken.latest$</latest> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> </row> <row> <panel> <title>API : Data/Search Count</title> <html id="errorcount5"> <style> #user{ text-align:center; color:#BFFF00; } </style> <h2 id="user"> API COUNT STATISTICS</h2> </html> </panel> </row> <row> <panel> <title>Total Request Data</title> <table> <search> <query>(index=$indexToken$ source="/aws/lambda/api-data-$stageToken$-$entityToken$" OR source="/aws/lambda/api-commands-$stageToken$-*") ge:*:init:*:invoke | spath path=event.path output=path | spath path=event.httpMethod output=http | eval Path=http + " " + path |stats count by Path</query> <earliest>$timeToken.earliest$</earliest> <latest>$timeToken.latest$</latest> <refresh>60m</refresh> <refreshType>delay</refreshType> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> <panel> <title>Total Request Search</title> <table> <search>rliest><query>index=$indexToken$ source IN ("/aws/lambda/api-search-$stageToken$-$entityToken$") ge:init:*:invoke | spath path=path output=path | spath path=httpMethod output=http | eval Path=http + " " + path |stats count by Path</query> <earliest>$timeToken.earliest$</earliest> <latest>$timeToken.latest$</latest> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> <panel> <title>Total Error Count :</title> <table> <search>rliest><query>index=$indexToken$ source IN ("/aws/lambda/api-search-$stageToken$-$entityToken$") msg="error*" (error.status=4* OR error.status=5*) | eval status=case(like(error.status, "4%"), "4xx", like(error.status, "5%"), "5xx") | stats count by error.status</query> <earliest>$timeToken.earliest$</earliest> <latest>$timeToken.latest$</latest> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> <panel> <title>Response Time Count in ms</title> <table> <search>rliest><query>index=np-papi source IN ("/aws/lambda/api-search-test-*") "ge:init:search:response" | stats sum(responseTime) as TotalResponseTime, avg(responseTime) as AvgResponseTime | eval API="Search API" | eval TotalResponseTime = TotalResponseTime . " ms" | eval AvgResponseTime = round(AvgResponseTime, 2) . " ms" | table API, TotalResponseTime, AvgResponseTime | append [ search index=np-papi source IN ("/aws/lambda/api-data-test-*") msg="ge:init:data:*" | stats sum(responseTime) as TotalResponseTime, avg(responseTime) as AvgResponseTime | eval API="DATA API" | eval TotalResponseTime = TotalResponseTime . " ms" | eval AvgResponseTime = round(AvgResponseTime, 2) . " ms" | table API, TotalResponseTime, AvgResponseTime ] | table API, TotalResponseTime, AvgResponseTime</query> <earliest>$timeToken.earliest$</earliest> <latest>$timeToken.latest$</latest> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> </row> <row> <panel> <html id="errorcount16"> <style> #user{ text-align:center; color:#BFFF00; } </style> <h2 id="user">Request per min</h2> </html> </panel> </row> <row> <panel> <table> <search> <query>index=$indexToken$ source IN ("/aws/lambda/api-data-$stageToken$-$entityToken$","/aws/lambda/api-search-$stageToken$-$entityToken$") "ge:init:*:*" | timechart span=1m count by source | untable _time source count | stats sum(count) as TotalCount, avg(count) as AvgCountPerMin by source | eval AvgCountPerMin = round(AvgCountPerMin, 2) | eval source = if(match(source, "api-data-test-(.*)"), replace(source, "/api-data-test-(.*)", "data-\\1"), if(match(source, "/aws/lambda/api-data-prod-(.*)"), replace(source, "/aws/lambda/api-data-prod-(.*)", "data-\\1"), if(match(source, "/aws/lambda/api-search-test-(.*)"), replace(source, "/aws/lambda/api-search-test-(.*)", "search-\\1"), replace(source, "/aws/lambdaapi-search-prod-(.*)", "search-\\1")))) | table source, TotalCount, AvgCountPerMin</query> <earliest>$timeToken.earliest$</earliest> <latest>$timeToken.latest$</latest> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> </row> <row> <panel> <title>SLA % :DATA API</title> <table> <search> <query>index=$indexToken$ source IN ("/aws/lambdaapi-data-$stageToken$-$entityToken$") "ge:init:data:responseTime" | eval SLA_threshold = 113 | eval SLA_compliant = if(responseTime <= SLA_threshold, 1, 0) | stats count as totalRequests, sum(SLA_compliant) as SLA_passed by source | eval SLA_percentage = round((SLA_passed / totalRequests) * 100, 2) | eval API = "DATA API" | table source, SLA_percentage, totalRequests, SLA_passed</query> <earliest>$timeToken.earliest$</earliest> <latest>$timeToken.latest$</latest> <refresh>60m</refresh> <refreshType>delay</refreshType> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> <panel> <title>SLA % :SEARCH API</title> <table> <search> <query>index=$indexToken$ source IN ("/aws/lambda/api-search-$stageToken$-$entityToken$") "ge:init:search:response:time" | eval SLA_threshold = 100 | eval SLA_compliant = if(responseTime <= SLA_threshold, 1, 0) | stats count as totalRequests, sum(SLA_compliant) as SLA_passed by source | eval SLA_percentage = round((SLA_passed / totalRequests) * 100, 2) | eval API = "SEARCH API" | eval source = if(match(source, "/aws/lambda/api-search-test-(.*)"), replace(source, "/aws/lambda\api-search-test-(.*)", "search-\\1"), replace(source, "/aws/lambda/api-search-prod-(.*)", "search-\\1")) | table source, SLA_percentage, totalRequests, SLA_passed</query> <earliest>$timeToken.earliest$</earliest> <latest>$timeToken.latest$</latest> <refresh>60m</refresh> <refreshType>delay</refreshType> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> </row> </form>

catdadof3 · ‎03-22-2025

I may be wrong, but I don't think the submit button will work in the form section. I think you'd want it in the fieldset like this: <fieldset submitButton="true" autoRun="false"> For #3 - I'm not 100% sure what you're asking, but I think you mean that you'd want "*-test-target" and "*-test-product" if test is selected from environment and "*-prod-target"/ "*-prod-product" if prod is selected? You can add conditions to change based on environment and use a base search to populate it. However, FYI this dropdown won't populate until after you hit submit if you leave the drop down in the fieldset with the submit button. <search id="token_base"> <query> | makeresults | eval token_name="name,address,ALL,Target,Product" | eval token_name=split(token_name, ",") | stats count by token_name | fields - count | eval token_value=CASE(token_name="name", "name,0", token_name="address", "address,0", token_name="ALL", "ALL", token_name="Target", "$target_tok$", token_name="Product", "$product_tok$") </query> </search> <fieldset submitButton="true" autoRun="false"> <input type="dropdown" token="indexToken1" searchWhenChanged="false"> <label>Environment</label> <choice value="prod,prod">PROD</choice> <choice value="np,test">TEST</choice> <change> <condition value="prod,prod"> <set token="target_tok">*-prod-target</set> <set token="product_tok">*-prod-product</set> <eval token="stageToken">mvindex(split($value$,","),1)</eval> <eval token="indexToken">mvindex(split($value$,","),0)</eval> </condition> <condition value="np,test"> <set token="target_tok">*-test-target</set> <set token="product_tok">*-test-product</set> <eval token="stageToken">mvindex(split($value$,","),1)</eval> <eval token="indexToken">mvindex(split($value$,","),0)</eval> </condition> </change> <default>np,test</default> </input> <input type="dropdown" token="entityToken" searchWhenChanged="false"> <label>Data Entity</label> <choice value="name,0">name</choice> <choice value="targetProduct,*-test-target">Target</choice> <choice value="product,*-test-product">Product</choice> <choice value="address,0">address</choice> <choice value="ALL">ALL</choice> <change> <condition value="ALL"> <set token="entityTokenFirst">*</set> </condition> <condition>  <set token="entityLabel">$label$</set> <eval token="searchName">mvindex(split($value$, ","),1)</eval> <eval token="entityTokenFirst">mvindex(split($value$, ","),0)</eval> </condition> </change> </input> <input type="dropdown" token="example_tok"> <label>Example dynamic dropdown</label> <search base="token_base"> <query/> </search> <fieldForLabel>token_name</fieldForLabel> <fieldForValue>token_value</fieldForValue> </input> <input type="time" token="timeToken" searchWhenChanged="false"> <label>Time</label> <default> <earliest>-24h@h</earliest> <latest>now</latest> </default> </input> </fieldset>

catdadof3 · ‎03-22-2025

Just to clarify - This how the data is coming into your index/source and you're trying to manipulate it via SPL? It looks something like this only an event vs a table? Just checking because I can't tell if this is one long string or an event that has multiple attributes. If it's an event, could you possibly take a screen shot? It looks like you'd have something where SYSINFO is the top level and each category below is another level. If that's the case, ideally you'd just have SYSINFO.number_of_subinterfaces as a field name you can table.

catdadof3 · ‎03-22-2025

Sorry, I'm a little confused by what you want. Do you want the $entityTokenFirst$ to be set to an * when the user selects ALL? If so, add a condition to your change. <input type="dropdown" token="entityToken" searchWhenChanged="false"> <label>Data Entity</label> <choice value="name,0">name</choice> <choice value="targetProduct,*-test-target">Target </choice> <choice value="product,*-test-product">Product </choice> <choice value="address,0">address</choice> <choice value="ALL">ALL</choice> <change> <condition value="ALL"> <set token="entityTokenFirst">*</set> </condition> <condition>  <set token="entityLabel">$label$</set> <eval token="searchName">mvindex(split($value$, ","),1)</eval> <eval token="entityTokenFirst">mvindex(split($value$, ","),0)</eval> </condition> </change> </input>

catdadof3 · ‎03-21-2025

I was able to replicate your problem - looks like if you use a table or fields command with the fields you need underneath the index search you can get results. <search id="recycle"> <query> index=o365_sharepoint AND (Operation=FileRecycled OR Operation=FolderRecycled OR Operation=FileVersionsAllDeleted) | fields UserId Whateverotherfields </query> <earliest>-7d@h</earliest> <latest>now</latest> </search>

catdadof3 · ‎12-07-2022

This is exactly what I needed! I think my issue was trying to add in 2 tokens instead of 1 in the range values. Thank you!

catdadof3 · ‎12-06-2022

Hi all, I have a dashboard that has a single value panel. I am trying to make a dynamic panel that will change with the data. I need to display the result number in the panel, but the coloring needs to be dependent on another number. Example data: Total Sandwiches Made Name Cheese Ham PB Turkey sum marker topTh Total 1110 270 110 710 Total 2 110 2200 Bill 400 100 20 600 2 110 1120 Pam 700 120 80 100 2 110 1000 Finn 10 50 10 10 1 110 80 And the example SPL: index=food sourcetype=sandwiches | stats sum(Cheese) as Cheese sum(Ham) as Ham sum(PB) as PB sum(Turkey) as Turkey by Name | addtotals row=t col=t labelfield="sum" | eval topTh=case(sum="Total", (Total*.05), 1=1, null()) | sort topTh | filldown topTh | eval marker=if(Total>=topTh, 2,1) Basically, if the marker is 1, I'd like the color of the number to be one color and a different one for 2 while still displaying the 'Total' field. I have the options as this: <option name="colorBy">value</option> <option name="drilldown">all</option> <option name="field">Total</option> <option name="rangeColors">["0x53A051","0xeb5654"]</option> <option name="rangeValues">[$lowerThresh$,$upperThresh$]</option> <option name="refresh.display">none</option> <option name="useColors">1</option> and additional logic above it: <done> <condition match="'result.marker'==2"> <set token="lowerThresh">1</set> <set token="upperThresh">2</set> </condition> </done> Any help would be greatly appreciated.

Posts	7
Solutions	2
Karma Given	1
Karma Received	3
Member Since	‎12-06-2022

Online Status	Offline
Date Last Visited	‎03-31-2025 03:24 PM

Variable range values with a token?

Re: submit button not working

Re: submit button not working

Re: How to extract value with dynamic key name

Re: custom Dropdrown with "ALL'

Re: Base search not returning results

Re: Variable range values with a token?

Variable range values with a token?

Are you a member of the Splunk Community?