hello,
i have a dashboard with multiselect input and dropdown input but for some reason they are both greyed out and the search is not updating after selecting at the first time.
also i have no option to configure default value for both of them
<form>
<label>List of Pause Events with Times</label>
<fieldset submitButton="false">
<input type="multiselect" token="serialnumber" searchWhenChanged="false">
<label>Serial Number</label>
<prefix>SerialNumber = </prefix>
<fieldForLabel>sn</fieldForLabel>
<fieldForValue>sn</fieldForValue>
<search>
<query>index="emea_fdm" | `SerialNumber`</query>
<earliest>0</earliest>
<latest></latest>
</search>
<delimiter>OR</delimiter>
</input>
<input type="dropdown" token="sourcetype" searchWhenChanged="false">
<label>Source Type</label>
<prefix>sourcetype = "</prefix>
<suffix>"</suffix>
<fieldForLabel>st</fieldForLabel>
<fieldForValue>st</fieldForValue>
<search>
<query>index="emea_fdm" sourcetype="fdm_*_system"</query>
<earliest>0</earliest>
<latest></latest>
</search>
</input>
</fieldset>
<row>
<panel>
<title>EMEA</title>
<table>
<search ref="List of Pause Events with Times"></search>
<option name="count">20</option>
<option name="drilldown">cell</option>
<drilldown>
<link target="_blank">/app/St/report?s=SSYS-List%20of%20Pause%20Events%20with%20Times</link>
</drilldown>
</table>
</panel>
</row>
</form>
@sarit_s
Can you please confirm your searches are returning results?
index="emea_fdm" | `SerialNumber`
index="emea_fdm" sourcetype="fdm_*_system"
[Updated]
The issue is resolved.
The serialnumber
macro was missing. We have updated searches during troubleshooting. All the followed troubleshooting steps are mentioned in the below comments.
Happy Splunking
@sarit_s
Can you please confirm your searches are returning results?
index="emea_fdm" | `SerialNumber`
index="emea_fdm" sourcetype="fdm_*_system"
[Updated]
The issue is resolved.
The serialnumber
macro was missing. We have updated searches during troubleshooting. All the followed troubleshooting steps are mentioned in the below comments.
Happy Splunking
yes they are
@sarit_s
This is just for troubleshooting:
Can you please try by adding static value in both multiselects?
<choice value="Data1">Value1</choice>
It looks like this:
<fieldset submitButton="false">
<input type="multiselect" token="serialnumber" searchWhenChanged="false">
<label>Serial Number</label>
<prefix>SerialNumber = </prefix>
<fieldForLabel>sn</fieldForLabel>
<fieldForValue>sn</fieldForValue>
<search>
<query>index="emea_fdm" | `SerialNumber`</query>
<earliest>0</earliest>
<latest></latest>
</search>
<delimiter>OR</delimiter>
<choice value="Data1">Value1</choice>
</input>
<input type="dropdown" token="sourcetype" searchWhenChanged="false">
<label>Source Type</label>
<prefix>sourcetype = "</prefix>
<suffix>"</suffix>
<fieldForLabel>st</fieldForLabel>
<fieldForValue>st</fieldForValue>
<search>
<query>index="emea_fdm" sourcetype="fdm_*_system"</query>
<earliest>0</earliest>
<latest></latest>
</search>
<choice value="Data1">Value1</choice>
</input>
</fieldset>
its now not grayed out but it canceled the dynamic search
@sarit_s
Can you please update searches with below and try?
index="emea_fdm" sn=* | head 10 | `SerialNumber` | table sn
index="emea_fdm" sourcetype="fdm_*_system" st=* | head 10 | table st
@sarit_s
Can you please try these searches in search bar?? Make sure the app context would be the same for search bar which your dashboard belongs. I think your searches are not returning results properly or search being failed during execution.
For Source Type search: there is a space between head
and 10
like head 10
both your searches returning no result but my searches returning results
If searches are not returning any events then your events don't have filed sn
and st
. Can you please check it?
index="emea_fdm" | table time sn _raw
index="emea_fdm" sourcetype="fdm*_system" | table _time st _raw
Please open search bar using below URL.
https://<<SPLUNK>>:8000/en-GB/app/<<MY_APP>>/search
where
<<SPLUNK>>
is your Splunk instance
<<MY_APP>>
is your app folder name
i have field "sourcetype" and field "SerialNumber"
changing Field For Label and Field For Value to be sourcetype and SerialNumber didn't change anything
@sarit_s
Can you please try below search for second multi-select?
index="" sourcetype="fdm__system" | fields sourcetype
does not return anything
but if im changing it to index="" sourcetype="fdm__system" | fields sourcetype it returns results
@sarit_s
my bad. I forget to press ctrl+K. 🙂 🙂
Try this:
index="*" sourcetype="fdm_*_system" | fields sourcetype
i updated my answer , i add * by myself 🙂
with * it returning results
@sarit_s
So I think the problem is with index
name. Can you please check index name by executing below search??
index="*" sourcetype="fdm_*_system" | stats count sourcetype, index
And I think we are populating dropdown. So our searches should be like this.
index="emea_fdm" | `SerialNumber` | dedup SerialNumber | table SerialNumber
index="emea_fdm" sourcetype="fdm_*_system" | dedup sourcetype | table
But can you please try below in your dashboard?
index="*" | `SerialNumber` | dedup SerialNumber | table SerialNumber
index="*" sourcetype="fdm_*_system" | dedup sourcetype | table
ok so this searches fixed the error msg but still if i choose one of the options it does not change the panel results.
actually nothing happens..
also, i want sourcetype dropdown to update automatically after choosing serialnumber and also serialnumber to update automatically after choosing sorucetype.
is it possible ?
ooh..
So you need to create a token which can be used in another search. For that, you have to add <change>
tag in select input.
Please check below link for same:
hi.
i think that something basic in missing since im getting very weird error msg
"Error in 'table' command: Invalid argument: '-'
i have no idea what this error is about since i don't have this argument in my search
also, i saw this :
Note: The element is not
available for multiselect inputs.
so , if i want to use multiselect, how can i do it ?
@sarit_s
Can you please share your sample dashboard XML?
few updates
i succeeded to refresh the dropdowns if one of them is changing
but the event list does not change when changing the "SerialNumber" dropdown
if changing "sourcetype" dropdown it is working
also, i need "SerialNumber" to be multiselect or any other type only to be able to choose more than one option
and also, the option "ALL" is not working. if im configuring "ALL=*" im getting error
<label>panel test</label>
<fieldset submitButton="false">
<input type="dropdown" token="Region" searchWhenChanged="true">
<label>Region</label>
<choice value="ALL">ALL</choice>
<choice value="EMEA">EMEA</choice>
<choice value="APJ">APJ</choice>
</input>
<input type="dropdown" token="sourcetype" searchWhenChanged="true">
<label>SourceType</label>
<choice value="ALL">ALL</choice>
<fieldForLabel>sourcetype</fieldForLabel>
<fieldForValue>sourcetype</fieldForValue>
<search>
<query>index="$Region$_fdm" sourcetype="fdm_*_system" |dedup sourcetype |table sourcetype</query>
<earliest>0</earliest>
<latest></latest>
</search>
</input>
<input type="dropdown" token="serialNumber" searchWhenChanged="true">
<label>SerialNumber</label>
<choice value="ALL">ALL</choice>
<fieldForLabel>SerialNumber</fieldForLabel>
<fieldForValue>SerialNumber</fieldForValue>
<search>
<query>index="$Region$_fdm" sourcetype=$sourcetype$ | rex field=source \/ssyssplunk\/\w+\/\w+\/\w+\/\w+\/(?<SerialNumber>\w+) | dedup SerialNumber |table SerialNumber</query>
<earliest>0</earliest>
<latest></latest>
</search>
</input>
</fieldset>
<row>
<panel>
<title>paused reasons by Region</title>
<table>
<title>$Region$</title>
<search>
<query>index="$Region$_fdm" sourcetype=$sourcetype$ pauseReason: NOT "pauseReason: NotPaused" pauseReason: NOT "pauseReason: UserPaused" |`SerialNumber`=$SerialNumber$| `pauseReason` | table _time pause_reason SerialNumber sourcetype source</query>
<earliest>0</earliest>
<latest></latest>
</search>
<option name="count">10</option>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
</form>