Dashboards & Visualizations

Token is set incorrect in input panel with rejects

GersonGarcia
Path Finder

All, I have a dashboard that depends of a token set in the session it will change the type of input panel. It uses rejects to enable/disable different inputs based on token.

This is the simple xml where I select which input should be used:

<form hideChrome="false">
  <init>
    <set token="ops">1</set>
    <!--<set token="eng">1</set>-->
    <unset token="mytoken"></unset>
  </init>
  <label>App Metrics</label>
  <description>APP NAME</description>
  <fieldset autoRun="false" submitButton="true">
    <input type="dropdown" token="mytoken" searchWhenChanged="false" rejects="$eng$">
      <label>select service</label>
      <search>
        <query>| tstats count where index=apps sourcetype=myapp  by mytoken | dedup mytoken | fields - count</query>
        <earliest>-7d@h</earliest>
        <latest>now</latest>
      </search>
      <fieldForLabel>mytoken</fieldForLabel>
      <fieldForValue>mytoken</fieldForValue>
      <change>
        <unset token="shost"></unset>
        <!--<unset token="mytoken"></unset>-->
      </change>
    </input>
    <input type="dropdown" token="shost" searchWhenChanged="false" rejects="$ops$">
      <label>select host</label>
      <search>
        <query>| tstats count where index=apps sourcetype=myapp by host | rename host as shost | fields - count</query>
        <earliest>-7d@h</earliest>
        <latest>now</latest>
      </search>
      <fieldForLabel>shost</fieldForLabel>
      <fieldForValue>shost</fieldForValue>
      <change>
        <set token="mytoken"></set>
      </change>
    </input>

This is the panel that result after mytoken is selected (or not)





| tstats count where index=apps sourcetype=myapp app_service_name=$mytoken$ by mytoken host | fields - count
-7d
now
1

50
none
cell
false
true
false
false

'row.host'



So the idea is when the dashboard is deployed in ENG Splunk env I set $eng$ and if it is in PROD, I set $ops$ instead.

If the dashboard is ENG, the input should be base on host and mytoken should be set to '' (just for tittles)

If the dashboard is PROD ($ops$) the input will be base on $mytoken$ since there may be multiple hosts with the same $token$.

The problem I am seeing is that mytoken is set with '' by the session on the rejects input, and causing the following error message:

"Comparator '=' is missing a term on the right hand side"

I am not sure what I am doing wrong.

Thank you,

Gerson

Tags (1)
0 Karma

DalJeanis
SplunkTrust
SplunkTrust

1) You are confusing the name of the token with the underlying field name and the value of the field. Your query to populate mytoken needs to be on the underlying field.

Try this ...

 <input type="dropdown" token="mytoken" searchWhenChanged="false" rejects="$eng$">
   <label>select service</label>
   <search>
     <query>| tstats count where index=apps sourcetype=myapp  by app_service_name | rename app_service_name as mytoken| fields - count</query>
     <earliest>-7d@h</earliest>
     <latest>now</latest>
   </search>
   <fieldForLabel>mytoken</fieldForLabel>
   <fieldForValue>mytoken</fieldForValue>
   <change>
     <unset token="shost"></unset>
     <!--<unset token="mytoken"></unset>-->
   </change>
 </input>

That should correct the plumbing on the top half, but you still need to account for what happens if you pass a null mytoken.

Try this -

| tstats count where index=apps sourcetype=myapp app_service_name=$mytoken$* by mytoken host 
| fields - count 

If your app names are distinct, then it will work. If, however, there may be an app name that is a shorter subset of the beginning of another app name -- App1X vs App1X00, for instance -- then you will probably have to build a slightly more complex screen that creates the token as token2 = "app_service_name=$mytoken$" or token2 = "".

0 Karma

woodcock
Esteemed Legend

When you reference your token, you need to bound it with dollar-signs $, like this:

<query>| tstats count where index=apps sourcetype=myapp  by $mytoken$ | dedup $mytoken$ | fields - count</query>
0 Karma

GersonGarcia
Path Finder

@woodcock, no that is not it. This search:

| tstats count where index=apps sourcetype=myapp  by mytoken | dedup mytoken | fields - count

Is correct since that is exactly what I need to show in the dropdown list. 'mytoken' in this case is a field in the record.

Also the reject is working because when I set $ops$ this input panel is not visible.

But even though it is not visible, it is setting $mytoken$ with blank:

<set token="mytoken"></set>

If I change it to

<set token="mytoken">Anything</set>

Then, mytoken is passed to the next panel with Anything.

Weird, humm?

Thank you,
Gerson

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...