Dashboards & Visualizations

Is it possible to set the sampleRatio for a search using a drop-down token with XML?

dbcase
Motivator

Hi,

I have the below XML code. What I'm trying to do is use a drop-down so the user can select a sampling ratio for the query. Splunk complains with this error message. Is it possible to use a drop-down to set the sampling ratio?

XML Syntax Error: invalid literal for int() with base 10: "'$compare_mso_sample$'"



<input type="dropdown" token="compare_mso_sample" searchWhenChanged="true">
        <label>Select a Sampling Ratio:</label>
        <default>1:100</default>
        <choice value="0">0 - All Events (Computationally HEAVY)</choice>
        <choice value="10">1:10</choice>
        <choice value="25">1:25</choice>
        <choice value="50">1:50</choice>
        <choice value="75">1:75</choice>
        <choice value="100">1:100</choice>
        <choice value="150">1:150</choice>
        <choice value="200">1:200</choice>
        <choice value="300">1:300</choice>
        <choice value="500">1:500</choice>
        <choice value="750">1:750</choice>
        <choice value="1000">1:1000</choice>
        <choice value="5000">1:5000</choice>
      </input>
      <table>
      <title>BEA Codes for $time_field.earliest$</title>

        <search>
          <query>index="$mso_environment$" sourcetype=wls_managedserver | lookup beacodes.csv beacode as bea_code|chart values(desc) as Description sparkline(count(bea_code)) as Trend count(bea_code) as "BEA Code Count" by bea_code|sort -"BEA Code Count"|rename bea_code as "BEA CODE - Click for Detail"</query>
          <earliest>$time_field_mso.earliest$</earliest>
          <latest>$time_field_mso.latest$</latest>
           <sampleRatio>'$compare_mso_sample$'</sampleRatio>
0 Karma
1 Solution

maciep
Champion

I was able to do it on 6.5 on my test machine (windows 10). Have you tried removing the single quotes surrounding your token? Not sure why those are there?

Here is what I have:

<form>
  <label>sampling test</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="t_ratio" searchWhenChanged="true">
      <label>Ratio</label>
      <default>100</default>
      <choice value="0">0 - All Events (Computationally HEAVY)</choice>
      <choice value="10">1:10</choice>
      <choice value="25">1:25</choice>
      <choice value="50">1:50</choice>
      <choice value="75">1:75</choice>
      <choice value="100">1:100</choice>
      <choice value="150">1:150</choice>
      <choice value="200">1:200</choice>
      <choice value="300">1:300</choice>
      <choice value="500">1:500</choice>
      <choice value="750">1:750</choice>
      <choice value="1000">1:1000</choice>
      <choice value="5000">1:5000</choice>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>index=wineventlog earliest=@d | table _time, EventCode</query>
          <earliest>$earliest$</earliest>
          <latest>$latest$</latest>
          <sampleRatio>$t_ratio$</sampleRatio>
        </search>
      </table>
    </panel>
  </row>
</form>

View solution in original post

maciep
Champion

I was able to do it on 6.5 on my test machine (windows 10). Have you tried removing the single quotes surrounding your token? Not sure why those are there?

Here is what I have:

<form>
  <label>sampling test</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="t_ratio" searchWhenChanged="true">
      <label>Ratio</label>
      <default>100</default>
      <choice value="0">0 - All Events (Computationally HEAVY)</choice>
      <choice value="10">1:10</choice>
      <choice value="25">1:25</choice>
      <choice value="50">1:50</choice>
      <choice value="75">1:75</choice>
      <choice value="100">1:100</choice>
      <choice value="150">1:150</choice>
      <choice value="200">1:200</choice>
      <choice value="300">1:300</choice>
      <choice value="500">1:500</choice>
      <choice value="750">1:750</choice>
      <choice value="1000">1:1000</choice>
      <choice value="5000">1:5000</choice>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>index=wineventlog earliest=@d | table _time, EventCode</query>
          <earliest>$earliest$</earliest>
          <latest>$latest$</latest>
          <sampleRatio>$t_ratio$</sampleRatio>
        </search>
      </table>
    </panel>
  </row>
</form>

dbcase
Motivator

Interesting, must be a 6.5 thing. I'm on 6.4. Time to upgrade!

0 Karma

somesoni2
SplunkTrust
SplunkTrust

I had similar requirement for setting number of rows displayed in single page of table visualization and couldn't make it work. The reason was that tokens are treated as string (when used in search, splunk does implicit convert to number if required, but that doesn't happen on xml tags) and this property requires an integer value.

0 Karma

dbcase
Motivator

Hi Somesoni2,

Thanks for the reply! I'm guessing that there is no way to convert to an integer or have the original value be an integer?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...