Dashboards & Visualizations

Time Picker and Submit on Dashboard

louispaul76
Engager

Hello Everyone,

I'm trying to create a dashboard for my pair critical devices. I'm not sure what is wrong with my code or if it is the token. When I click on submit, I'm getting the error: Search is waiting for input.
See below my query:

(| inputlookup critical_devices.csv
| eval SplunkHost=lower(SplunkHost)
| join SplunkHost type=outer
[| metadata index=my indexes type=hosts
| rename totalCount as Count, host as SplunkHost, lastTime as "Last Event"
| eval actualhourslag=(now()-'Last Event')/60/60
| eval SplunkHost=lower(SplunkHost)]
| fieldformat "Last Event"=strftime('Last Event', "%c")
| where actualhourslag>HoursLag OR NOT actualhourslag="*"
| stats sum(Count) by SplunkHost
| rename sum(Count) as total

| lookup critical_devices.csv SplunkHost OUTPUT PairGroup
| search PairGroup!=""
| stats count() by PairGroup
| rename count(total) as DevicesPerPairNotResponding)

Any help would be really appreciated.

Best,

Louispaul

Tags (2)
0 Karma

Vijeta
Influencer

@louispaul76 where are you using the token , can you write the query or tag where the token is being used.

0 Karma

tscroggins
Influencer

Can you provide more context? The search contains no tokens, and as written, the search will fail with an unbalanced parentheses parsing error.

0 Karma

louispaul76
Engager

Here is the beginning of the search:

Critical Pair Devices

<input type="time" token="chosentime">
  <label></label>
  <default>
    <earliest>-24h@h</earliest>
    <latest>now</latest>
  </default>
</input>


<panel>
  <title>Pairs by time</title>
  <table>
0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...