Dashboards & Visualizations

Why does numeric input value keep dashboard search "Waiting for input"?

yuanliu
SplunkTrust
SplunkTrust

When I set a select list for a numeric field, panel search keeps "Waiting for input". Sample input:

      <input type="dropdown" token="score_tok" searchWhenChanged="true">
        <label>Severity cutoff</label>
        <choice value="10.0">Top</choice>
        <choice value="9.5">9.5</choice>
        <choice value="0.0">All</choice>
        <default>10.0</default>
      </input>

Sample search:

index=hubble score >= $score_tok$

I have used input tokens from dynamic search and from static values without problems. The only difference I can see is perhaps the use of static numeric values.

I can definitely run searches like index=hubble score>=10.0, even inside the panel search. I can also display values of $score_tok$ in the panel's title and so on. But score >= $score_tok$ inside the panel search always stalls. Suspecting that the decimal point may be causing problem, I even tried | where scroe >= tonumber($score_tok$), quoting the token, without decimal point, etc., to no avail. I even tried to throw the token value without comparison operator (i.e., just index=hubble $score_tok$), as long as the token returns only a numeric value, the search stalls.

The only alternative that works around the problem is to force the comparison search term into the input values, e.g.,

      <input type="dropdown" token="score_tok" searchWhenChanged="true">
        <label>Severity cutoff</label>
        <choice value="10">Top</choice>
        <choice value="9.5">≥ 9.5</choice>
        <choice value="0.0">All</choice>
        <default>10</default>
        <prefix>score >= </prefix>
      </input>

And change search to

index=hubble $score_tok$

Whereas this solves the problem, I am curious why the numeric value wouldn't be recognized as "input" even it can be displayed in title.

0 Karma
1 Solution

yuanliu
SplunkTrust
SplunkTrust

Very much like @luna23 discovered in this thread, the problem magically disappeared after my "workaround" that forced an initial value for $score_tok$ in the Splunk system. Now I can revert the to original algorithm and have selected value propagating into panel searches (and not just titles). Maybe I should have set <initialValue>10.0</initialValue> instead of just <default>10.0</default>. There is no way for me to know now that an initial value is set. I'd consider this a usability bug.

View solution in original post

yuanliu
SplunkTrust
SplunkTrust

Very much like @luna23 discovered in this thread, the problem magically disappeared after my "workaround" that forced an initial value for $score_tok$ in the Splunk system. Now I can revert the to original algorithm and have selected value propagating into panel searches (and not just titles). Maybe I should have set <initialValue>10.0</initialValue> instead of just <default>10.0</default>. There is no way for me to know now that an initial value is set. I'd consider this a usability bug.

lfedak_splunk
Splunk Employee
Splunk Employee

Hey @yuanliu, Nice job working out a workaround solution. Here's a link to report a bug if you would like to file a case about this workflow: http://www.splunk.com/r/bugs

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...