Dashboards & Visualizations

How to edit my dashboard to get the condition statement to work properly?

jeffbat
Path Finder

I am having an issue with getting a dashboard panel to work properly based off multiple input fields being chosen.

Basically, I have a dashboard that has 3 input fields; Tier 1 App, Role, Counter. right now I just have 2 apps listed (Exchange & OLB), for Role it would be App/Service, DB, Web/UI, and for Counter it is CPU, Memory, Disk.

What I need to happen is a token is being set based on Tier 1 App and Role combined.

I have tried this but it is not working.

  <fieldset submitButton="true">
    <input type="dropdown" token="tier1app" searchWhenChanged="false">
      <label>Tier 1 App</label>
      <choice value="Exchange">Exchange</choice>
      <choice value="OLB">OLB</choice>
    </input>
    <input type="dropdown" token="role" searchWhenChanged="false">
      <label>Role</label>
      <choice value="App/Service">App/Service</choice>
      <choice value="DB">DB</choice>
      <choice value="Web/UI">Web/UI</choice>
      <change>
        <condition label="App/Service">
          <condition $tier1app$="OLB">
            <set token="tier1servers">("VMSVC01.INSIDE","VMSVC02.INSIDE","VMWEBSVC01.INSIDE","VMWEBSVC02.INSIDE")</set>
          </condition>
          <condition $tier1app$="Exchange">
            <set token="tier1servers">("EXCH01.INSIDE","EXCH02.INSIDE","EXCHAZ01.INSIDE","EXCHAZ02.INSIDE"")</set>
          </condition>
        </condition>
        <condition label="DB">
          <set token="tier1servers">("SQLOB01.INSIDE","SQLOB02.INSIDE","SQLF01.INSIDE","SQLF02.INSIDE")</set>
        </condition>
        <condition label="Web/UI">
          <set token="tier1servers">("CVMUI01.INSIDE","CVMUI02.INSIDE")</set>
        </condition>
      </change>
    </input>
    <input type="dropdown" token="counter" searchWhenChanged="false">
      <label>Counter</label>
      <choice value="CPU">CPU</choice>
      <choice value="Disk">Disk</choice>
      <choice value="Memory">Memory</choice>
      <change>
        <condition label="CPU">
          <set token="counterchoice">| where (CounterName="% Processor Time")</set>
        </condition>
        <condition label="Disk">
          <set token="counterchoice">| where (CounterName="% Disk Used")</set>
        </condition>
        <condition label="Memory">
          <set token="counterchoice">| where (CounterName="% Memory Used")</set>
        </condition>
      </change>
    </input>
  </fieldset>

When trying to do the match on the token (tier1app) from the first input and the role in the second one, when running it just sits there and says Search is waiting for input...

Anyone have any ideas how to get this setup to work?

0 Karma
1 Solution

niketn
Legend

Hi Please try the following, I have also changed a bit to get rid of Submit button and enable search on change instead(since tokens are being set on change events anyways). Also since there is a dependency between tier1app and role dropdowns, I am unsetting tokens for role dropdown and tier1servers on change of tier1app value. You can change accordingly for counter dropdown as well or remove these changes, if you need submit button.

  <fieldset submitButton="false">
    <input type="dropdown" token="tier1app" searchWhenChanged="true">
      <label>Tier 1 App</label>
      <choice value="Exchange">Exchange</choice>
      <choice value="OLB">OLB</choice>
      <change>
        <unset token="role"></unset>
        <unset token="form.role"></unset>
        <unset token="tier1servers"></unset>
      </change>
    </input>
    <input type="dropdown" token="role" searchWhenChanged="true">
      <label>Role</label>
      <choice value="App/Service">App/Service</choice>
      <choice value="DB">DB</choice>
      <choice value="Web/UI">Web/UI</choice>
      <change>
        <condition match="$label$=&quot;App/Service&quot; AND $tier1app$=&quot;OLB&quot;">
          <set token="tier1servers">("VMSVC01.INSIDE","VMSVC02.INSIDE","VMWEBSVC01.INSIDE","VMWEBSVC02.INSIDE")</set>
        </condition>
        <condition match="$label$=&quot;App/Service&quot; AND $tier1app$=&quot;Exchange&quot;">
          <set token="tier1servers">("EXCH01.INSIDE","EXCH02.INSIDE","EXCHAZ01.INSIDE","EXCHAZ02.INSIDE"")</set>
        </condition>
        <condition label="DB">
          <set token="tier1servers">("SQLOB01.INSIDE","SQLOB02.INSIDE","SQLF01.INSIDE","SQLF02.INSIDE")</set>
        </condition>
        <condition label="Web/UI">
          <set token="tier1servers">("CVMUI01.INSIDE","CVMUI02.INSIDE")</set>
        </condition>
      </change>
    </input>
    <input type="dropdown" token="counter" searchWhenChanged="true">
      <label>Counter</label>
      <choice value="CPU">CPU</choice>
      <choice value="Disk">Disk</choice>
      <choice value="Memory">Memory</choice>
      <change>
        <condition label="CPU">
          <set token="counterchoice">| where (CounterName="% Processor Time")</set>
        </condition>
        <condition label="Disk">
          <set token="counterchoice">| where (CounterName="% Disk Used")</set>
        </condition>
        <condition label="Memory">
          <set token="counterchoice">| where (CounterName="% Memory Used")</set>
        </condition>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <html>
        $tier1app$
        <br/>$role$</br>
        <br/>$tier1servers$</br>
        <br/>$counter$</br>
        <br/>$counterchoice$</br>
      </html>
    </panel>
  </row>

PS: Final HTML Panel added to test out token changes.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

niketn
Legend

Hi Please try the following, I have also changed a bit to get rid of Submit button and enable search on change instead(since tokens are being set on change events anyways). Also since there is a dependency between tier1app and role dropdowns, I am unsetting tokens for role dropdown and tier1servers on change of tier1app value. You can change accordingly for counter dropdown as well or remove these changes, if you need submit button.

  <fieldset submitButton="false">
    <input type="dropdown" token="tier1app" searchWhenChanged="true">
      <label>Tier 1 App</label>
      <choice value="Exchange">Exchange</choice>
      <choice value="OLB">OLB</choice>
      <change>
        <unset token="role"></unset>
        <unset token="form.role"></unset>
        <unset token="tier1servers"></unset>
      </change>
    </input>
    <input type="dropdown" token="role" searchWhenChanged="true">
      <label>Role</label>
      <choice value="App/Service">App/Service</choice>
      <choice value="DB">DB</choice>
      <choice value="Web/UI">Web/UI</choice>
      <change>
        <condition match="$label$=&quot;App/Service&quot; AND $tier1app$=&quot;OLB&quot;">
          <set token="tier1servers">("VMSVC01.INSIDE","VMSVC02.INSIDE","VMWEBSVC01.INSIDE","VMWEBSVC02.INSIDE")</set>
        </condition>
        <condition match="$label$=&quot;App/Service&quot; AND $tier1app$=&quot;Exchange&quot;">
          <set token="tier1servers">("EXCH01.INSIDE","EXCH02.INSIDE","EXCHAZ01.INSIDE","EXCHAZ02.INSIDE"")</set>
        </condition>
        <condition label="DB">
          <set token="tier1servers">("SQLOB01.INSIDE","SQLOB02.INSIDE","SQLF01.INSIDE","SQLF02.INSIDE")</set>
        </condition>
        <condition label="Web/UI">
          <set token="tier1servers">("CVMUI01.INSIDE","CVMUI02.INSIDE")</set>
        </condition>
      </change>
    </input>
    <input type="dropdown" token="counter" searchWhenChanged="true">
      <label>Counter</label>
      <choice value="CPU">CPU</choice>
      <choice value="Disk">Disk</choice>
      <choice value="Memory">Memory</choice>
      <change>
        <condition label="CPU">
          <set token="counterchoice">| where (CounterName="% Processor Time")</set>
        </condition>
        <condition label="Disk">
          <set token="counterchoice">| where (CounterName="% Disk Used")</set>
        </condition>
        <condition label="Memory">
          <set token="counterchoice">| where (CounterName="% Memory Used")</set>
        </condition>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <html>
        $tier1app$
        <br/>$role$</br>
        <br/>$tier1servers$</br>
        <br/>$counter$</br>
        <br/>$counterchoice$</br>
      </html>
    </panel>
  </row>

PS: Final HTML Panel added to test out token changes.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...