Dashboards & Visualizations

Why does numeric input value keep dashboard search "Waiting for input"?

yuanliu
SplunkTrust
SplunkTrust

When I set a select list for a numeric field, panel search keeps "Waiting for input". Sample input:

      <input type="dropdown" token="score_tok" searchWhenChanged="true">
        <label>Severity cutoff</label>
        <choice value="10.0">Top</choice>
        <choice value="9.5">9.5</choice>
        <choice value="0.0">All</choice>
        <default>10.0</default>
      </input>

Sample search:

index=hubble score >= $score_tok$

I have used input tokens from dynamic search and from static values without problems. The only difference I can see is perhaps the use of static numeric values.

I can definitely run searches like index=hubble score>=10.0, even inside the panel search. I can also display values of $score_tok$ in the panel's title and so on. But score >= $score_tok$ inside the panel search always stalls. Suspecting that the decimal point may be causing problem, I even tried | where scroe >= tonumber($score_tok$), quoting the token, without decimal point, etc., to no avail. I even tried to throw the token value without comparison operator (i.e., just index=hubble $score_tok$), as long as the token returns only a numeric value, the search stalls.

The only alternative that works around the problem is to force the comparison search term into the input values, e.g.,

      <input type="dropdown" token="score_tok" searchWhenChanged="true">
        <label>Severity cutoff</label>
        <choice value="10">Top</choice>
        <choice value="9.5">≥ 9.5</choice>
        <choice value="0.0">All</choice>
        <default>10</default>
        <prefix>score >= </prefix>
      </input>

And change search to

index=hubble $score_tok$

Whereas this solves the problem, I am curious why the numeric value wouldn't be recognized as "input" even it can be displayed in title.

0 Karma
1 Solution

yuanliu
SplunkTrust
SplunkTrust

Very much like @luna23 discovered in this thread, the problem magically disappeared after my "workaround" that forced an initial value for $score_tok$ in the Splunk system. Now I can revert the to original algorithm and have selected value propagating into panel searches (and not just titles). Maybe I should have set <initialValue>10.0</initialValue> instead of just <default>10.0</default>. There is no way for me to know now that an initial value is set. I'd consider this a usability bug.

View solution in original post

yuanliu
SplunkTrust
SplunkTrust

Very much like @luna23 discovered in this thread, the problem magically disappeared after my "workaround" that forced an initial value for $score_tok$ in the Splunk system. Now I can revert the to original algorithm and have selected value propagating into panel searches (and not just titles). Maybe I should have set <initialValue>10.0</initialValue> instead of just <default>10.0</default>. There is no way for me to know now that an initial value is set. I'd consider this a usability bug.

lfedak_splunk
Splunk Employee
Splunk Employee

Hey @yuanliu, Nice job working out a workaround solution. Here's a link to report a bug if you would like to file a case about this workflow: http://www.splunk.com/r/bugs

0 Karma
Get Updates on the Splunk Community!

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...