Dashboards & Visualizations

Setting a token as a result of an input in a dashboard

matansocher
Contributor

Hi

I want to set a token in my dashboard after a user has entered an input.

this is my dashboard, after a try (in the 'change' tag, wanted to use the 'teamRegressions' I set and it doesent recognize it in my search):

<form>
  <label>Matan Regressions Test - v1.4</label>
  <fieldset submitButton="true" autoRun="false">
    <input type="dropdown" token="teamTests">
      <label>Team (Mandatory)</label>
      <choice value="TestsMultimediaCSV">camss</choice>
      <choice value="TestsPeriphCSV">periph</choice>
    </input>
    <input type="dropdown" token="groupID">
      <change>
        <eval token="teamRegressions">case($teamTests$=="TestsMultimediaCSV", "RegressionsMultimediaCSV", $teamTests$=="TestsPeriphCSV", "RegressionsCSV")</eval>
      </change>
      <label>Core (Mandatory)</label>
      <prefix>*</prefix>
      <fieldForLabel>groupID</fieldForLabel>
      <fieldForValue>groupID</fieldForValue>
      <search>
        <query>| inputcsv $teamRegressions$
| eval groupID = substr(groupID, 6, len(groupID))
| dedup groupID
| table groupID
| sort groupID</query>
        <earliest>0</earliest>
        <latest></latest>
      </search>
      <suffix>*</suffix>
    </input>
    <input type="dropdown" token="regression_target">
      <label>Chip (Mandatory)</label>
      <choice value="*">All</choice>
      <prefix>*</prefix>
      <fieldForLabel>regression_target</fieldForLabel>
      <fieldForValue>regression_target</fieldForValue>
      <search>
        <query>| inputcsv $teamRegressions$
| search groupID=$groupID$
| dedup regression_target
| table regression_target
| sort regression_target</query>
        <earliest>0</earliest>
        <latest></latest>
      </search>
      <suffix>*</suffix>
    </input>
  </fieldset>
  <row>
    <panel>
      <html>
        <h1>$teamRegressions$</h1>
      </html>
    </panel>
  </row>
  <row>
    <panel>
      <title>Best Regresion per week</title>
      <chart>
        <search>
          <query>| inputcsv $teamTests$ 
| search groupID=$groupID$ regression_target=$regression_target$
| dedup thumb_print test_id

| search 
    [| inputcsv $teamRegressions$ 
    | search groupID=$groupID$ regression_target=$regression_target$ 
    | eval _time = strptime(regression_start_time, "%Y.%m.%d_%H:%M:%S") 
    | eval Day1ofWeek = strftime(relative_time(_time,"@w0"),"%m/%d/%Y") 
    | sort -regression_target -Day1ofWeek -PASS 
    | streamstats count as counter by regression_target Day1ofWeek 
    | where counter <= 1 
    | rename a as "this is a set of thumb_prints of the best regressions from each week" 
    | table thumb_print] 

| eval job_start_time = strftime(job_start_time, "%Y.%m.%d_%H:%M:%S")
| eval job_end_time = strftime(job_end_time, "%Y.%m.%d_%H:%M:%S")
| eval Day1ofWeek = strftime(relative_time(_time,"@w0"),"%m/%d/%Y")
| table _time Day1ofWeek thumb_print test_id state status job_start_time job_end_time 

| fillnull value=0 

| eval _time = strptime(Day1ofWeek, "%m/%d/%Y")
| stats count(eval(status=="INCOMPLETE")) as INCOMPLETE count(eval(status=="INCONCLUSIVE")) as INCONCLUSIVE count(eval(status=="RUNNING")) as RUNNING count(eval(status=="FAIL")) as FAIL count(eval(status=="PASS")) as PASS by Day1ofWeek
| eval "Pass %" = floor((PASS / (PASS+FAIL+INCOMPLETE+INCONCLUSIVE+RUNNING))*100)</query>
          <earliest>-30d@d</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.axisTitleX.text">Date</option>
        <option name="charting.axisTitleY.text">Number Of Tests</option>
        <option name="charting.axisTitleY2.text">Pass %</option>
        <option name="charting.axisY2.enabled">1</option>
        <option name="charting.axisY2.maximumNumber">100</option>
        <option name="charting.axisY2.minimumNumber">0</option>
        <option name="charting.chart">column</option>
        <option name="charting.chart.overlayFields">"Pass %"</option>
        <option name="charting.chart.showDataLabels">all</option>
        <option name="charting.chart.stackMode">stacked</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.fieldColors">{"PASS":10FF00,"FAIL":FF0000,"INCOMPLETE":0015FF,"INCONCLUSIVE":FF00EE,"RUNNING":FF9000,"Pass %":FFEE00}</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.legend.placement">bottom</option>
        <option name="height">500</option>
      </chart>
    </panel>
  </row>
</form>

what am I doing wrong?

Thanks

0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

HI

In your dahsboard xml, you are using $teamRegressions$ token on change of "Core (Mandatory)" input. Don't you think it should be on change of "Team (Mandatory)" ?

can you please change these two inputs?

<input type="dropdown" token="teamTests">
       <label>Team (Mandatory)</label>
       <choice value="TestsMultimediaCSV">camss</choice>
       <choice value="TestsPeriphCSV">periph</choice>
       <change>
         <eval token="teamRegressions">case($value$=="TestsMultimediaCSV", "RegressionsMultimediaCSV", $value$=="TestsPeriphCSV", "RegressionsCSV")</eval>
       </change>
     </input>
     <input type="dropdown" token="groupID">
       <label>Core (Mandatory)</label>
       <prefix>*</prefix>
       <fieldForLabel>groupID</fieldForLabel>
       <fieldForValue>groupID</fieldForValue>
       <search>
         <query>| inputcsv $teamRegressions$
 | eval groupID = substr(groupID, 6, len(groupID))
 | dedup groupID
 | table groupID
 | sort groupID</query>
         <earliest>0</earliest>
         <latest></latest>
       </search>
       <suffix>*</suffix>
     </input>

View solution in original post

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

HI

In your dahsboard xml, you are using $teamRegressions$ token on change of "Core (Mandatory)" input. Don't you think it should be on change of "Team (Mandatory)" ?

can you please change these two inputs?

<input type="dropdown" token="teamTests">
       <label>Team (Mandatory)</label>
       <choice value="TestsMultimediaCSV">camss</choice>
       <choice value="TestsPeriphCSV">periph</choice>
       <change>
         <eval token="teamRegressions">case($value$=="TestsMultimediaCSV", "RegressionsMultimediaCSV", $value$=="TestsPeriphCSV", "RegressionsCSV")</eval>
       </change>
     </input>
     <input type="dropdown" token="groupID">
       <label>Core (Mandatory)</label>
       <prefix>*</prefix>
       <fieldForLabel>groupID</fieldForLabel>
       <fieldForValue>groupID</fieldForValue>
       <search>
         <query>| inputcsv $teamRegressions$
 | eval groupID = substr(groupID, 6, len(groupID))
 | dedup groupID
 | table groupID
 | sort groupID</query>
         <earliest>0</earliest>
         <latest></latest>
       </search>
       <suffix>*</suffix>
     </input>
0 Karma

matansocher
Contributor

Thanks!! I probably did not understand the meaning of the tag

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

oops. I just mistyped token name. My answer is updated. can you please try it?

0 Karma

matansocher
Contributor

it did work

0 Karma

niketn
Legend

@matansocher, please accept the answer by Kamlesh if it has resolved your issue.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...