Splunk Search

Why am I getting different Results when using a token in a timechart count By Action search compared to when I use the same search without the tokens?

tnoelOTS
Explorer

I am Trying to build a Dashboard based on the below search with a drop down picker for time span and a drop down Button for sourcetype. When I ran the search without the pickers it runs great I get multiple actions log in, log out, and Null to name a few. But When I use the search with time pickers the only action column I get is null. I have checked answers and the docs but I am unable to figure out why the other columns are not showing up when I use the picker/tokens in the search.

Base Search:

sourcetype="YYY_XXX"
|timechart span=15m count by Action limit=0

Dashboard search with Tokens:

?CU?
|timechart $Span$ count by Action limit=0

Dashborad XML







YYY1
YYY2
YYY3
_xxx
sourcetype=



Default
1 min
5 min
10 min
20 min
1 hour
2 hour






?CU?
|timechart $Span$ count by Action

-4h@m
now
1

20
none
none
false
progressbar
false
false
true




0 Karma
1 Solution

niketn
Legend

@tnoelOTS, I think you meant $CU$ in your code not ?CU?. Nevertheless, only if correct field name Action is not picked up by any sourcetype the timechart command would show NULL field alone.

Following is a run anywhere dashboard based on three sourcetypes from Splunk's _internal index i.e. splunkd_access, splunkd_ui_access, splunk_web_access with common field called method available in all three.

I have just added default values for CU and Span dropdown and added a Time Picker. PS: default value of space in Span implies Splunk will pick up span based on selected timerange.

<form>
  <label>Dashboard with tokens</label>
  <fieldset submitButton="false" autoRun="false">
    <input type="dropdown" token="CU" searchWhenChanged="true">
      <label>Credit Union</label>
      <choice value="*">all</choice>
      <choice value="splunkd">Splunk</choice>
      <choice value="splunkd_ui">Splunkd UI</choice>
      <choice value="splunk_web">Splunkd Web</choice>
      <suffix>_access"</suffix>
      <prefix>sourcetype="</prefix>
      <default>*</default>
    </input>
    <input type="time" token="tokTime" searchWhenChanged="true">
      <label>Time</label>
      <default>
        <earliest>-4h@m</earliest>
        <latest>now</latest>
      </default>
    </input>
    <input type="dropdown" token="Span" searchWhenChanged="true">
      <label>Span</label>
      <choice value=" ">Default</choice>
      <choice value="span=1m">1 min</choice>
      <choice value="span=5m">5 min</choice>
      <choice value="span=10m">10 min</choice>
      <choice value="span=20m">20 min</choice>
      <choice value="span=1h">1 hour</choice>
      <choice value="span=2h">2 hour</choice>
      <default> </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <chart>
        <search>
          <query>index=_internal $CU$
| timechart $Span$ count by method</query>
          <earliest>$tokTime.earliest$</earliest>
          <latest>$tokTime.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.chart">line</option>
        <option name="charting.drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </chart>
    </panel>
  </row>
</form>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

niketn
Legend

@tnoelOTS, I think you meant $CU$ in your code not ?CU?. Nevertheless, only if correct field name Action is not picked up by any sourcetype the timechart command would show NULL field alone.

Following is a run anywhere dashboard based on three sourcetypes from Splunk's _internal index i.e. splunkd_access, splunkd_ui_access, splunk_web_access with common field called method available in all three.

I have just added default values for CU and Span dropdown and added a Time Picker. PS: default value of space in Span implies Splunk will pick up span based on selected timerange.

<form>
  <label>Dashboard with tokens</label>
  <fieldset submitButton="false" autoRun="false">
    <input type="dropdown" token="CU" searchWhenChanged="true">
      <label>Credit Union</label>
      <choice value="*">all</choice>
      <choice value="splunkd">Splunk</choice>
      <choice value="splunkd_ui">Splunkd UI</choice>
      <choice value="splunk_web">Splunkd Web</choice>
      <suffix>_access"</suffix>
      <prefix>sourcetype="</prefix>
      <default>*</default>
    </input>
    <input type="time" token="tokTime" searchWhenChanged="true">
      <label>Time</label>
      <default>
        <earliest>-4h@m</earliest>
        <latest>now</latest>
      </default>
    </input>
    <input type="dropdown" token="Span" searchWhenChanged="true">
      <label>Span</label>
      <choice value=" ">Default</choice>
      <choice value="span=1m">1 min</choice>
      <choice value="span=5m">5 min</choice>
      <choice value="span=10m">10 min</choice>
      <choice value="span=20m">20 min</choice>
      <choice value="span=1h">1 hour</choice>
      <choice value="span=2h">2 hour</choice>
      <default> </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <chart>
        <search>
          <query>index=_internal $CU$
| timechart $Span$ count by method</query>
          <earliest>$tokTime.earliest$</earliest>
          <latest>$tokTime.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.chart">line</option>
        <option name="charting.drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </chart>
    </panel>
  </row>
</form>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...