Dashboards & Visualizations

Why does my cloned dashboard have "waiting for input" message but the original dashboard is working?

skyluke70
New Member

Hi all somebody can help me?
if I add a clone a dashboard on overview dashboard, I have this result "waiting for input". but I see the original dashboard is working good.
this is my graph

  <title>Top Source IP</title>
  <chart>
    <search>
      <query>| tstats summariesonly=true count FROM datamodel="ftnt_fos" where nodename="log.traffic" $srcip$ $dstip$  $user$ $app$ $vdom$ $device$   $srcintf$ $dstintf$  groupby log.srcip | sort -count | head 20</query>
      <earliest>$time_token.earliest$</earliest>
      <latest>$time_token.latest$</latest>
    </search>
    <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
    <option name="charting.axisLabelsX.majorLabelStyle.rotation">-45</option>
    <option name="charting.axisTitleX.visibility">collapsed</option>
    <option name="charting.axisTitleY.visibility">collapsed</option>
    <option name="charting.axisTitleY2.visibility">visible</option>
    <option name="charting.axisX.scale">linear</option>
    <option name="charting.axisY.scale">linear</option>
    <option name="charting.axisY2.enabled">0</option>
    <option name="charting.axisY2.scale">inherit</option>
    <option name="charting.chart">column</option>
    <option name="charting.chart.bubbleMaximumSize">50</option>
    <option name="charting.chart.bubbleMinimumSize">10</option>
    <option name="charting.chart.bubbleSizeBy">area</option>
    <option name="charting.chart.nullValueMode">gaps</option>
    <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
    <option name="charting.chart.stackMode">stacked</option>
    <option name="charting.chart.style">shiny</option>
    <option name="charting.drilldown">all</option>
    <option name="charting.layout.splitSeries">0</option>
    <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
    <option name="charting.legend.placement">none</option>
  </chart>
</panel>

somebody have a solution?
thanks for help

0 Karma

woodcock
Esteemed Legend

That is not a dashboard, that is a panel. If the dashboard that is hosting that panel does not contain a timepicker that sets time_token as well as other "stuff" that set the srcip, dstip, user, app, vdom, device, srcintf and dstintf tokens, then your panel('s search) will not run.

0 Karma

sathwikr076
Communicator

we have the same problem. we have time_token set for timepicker, can you please let me know how to make that work.
Thanks.

0 Karma

woodcock
Esteemed Legend

The easiest way is to view the dashboard, click Edit, then click the magnifying glass icon whose tooltip says, Edit search, then on the Time Range control, then click Use Time Picker and select Shared Timepicker (time_token), then click the green Apply button, then click the green Save button.

0 Karma

adonio
Ultra Champion

check permissions on the cloned dashboard?

0 Karma

skyluke70
New Member

hi
how i can control permission?

0 Karma

adonio
Ultra Champion

click on dashboards on nav bar -> find the cloned dashboard -> click edit -> permissions -> if its private, change to app context.
permissions is a wild guess that works more than 50% of the times in my little experience

0 Karma

skyluke70
New Member

do not work the permission it's ok but when i edit dashboard and want add clone panel i have always the same result waiting for input.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...