hi
In my dashboard, I use the search below
This search is updated from a dropdown list token (tok_filtersite)
[| inputlookup host.csv
| table host] index="x" sourcetype="perfmonmk:process"
| bucket _time span=3m
| where process_cpu_used_percent>80
| lookup lookup_cmdb_fo_all.csv HOSTNAME as host output SITE
**| search SITE=$tok_filtersite|s$**
| stats dc(process_name) as Total by host
| sort -Total limit=10
This token is also used in the drilldown associated to my search (where SITE=$SITE$)
[| inputlookup host.csv
| table host] index="x" sourcetype="perfmonmk:process"
| bucket _time span=3m
| where process_cpu_used_percent>80
| dedup host process_name
| lookup lookup_cmdb_fo_all.csv HOSTNAME as host output SITE COUNTRY TOWN ROOM
**| where SITE=$SITE$**
| eval time = strftime(_time, "%m/%d/%Y %H:%M")
| eval process_cpu_used_percent=round(process_cpu_used_percent,2). " %"
| stats latest(time) as time, values(COUNTRY) as COUNTRY, values(TOWN) as TOWN, values(SITE) as SITE, values(ROOM) as ROOM, latest(process_cpu_used_percent) as process_cpu_used_percent by host process_name
| sort -Total
| table time host COUNTRY TOWN SITE ROOM process_cpu_used_percent
| sort -Total
It works perfectly except when I choose *
in my dropdown list
If I choose *
, the data are well updated in the main dashboard but when I click on my report in order to open the drilldown, this one is empty
What I have to do to display data in my drilldown when I choose * in my dropdown list please??
thanks in advance
Any chance we can get the xml ?
could it have helped?
hey @jip31, from what I understand the second search is not giving you any results when you use something other than *
, is that right ?
Have you tried adding quotes for the token SITE="$SITE$"
or escaping it in case there are special characters SITE="$SITE|s$"
hey, yes its right
when i m doing SITE="$SITE$"
, i have an issue :
"error in where command typechecking failed "" only takes numbers"
and when I m doing SITE="$SITE|s$"
I have another issue
"error in where command the operator at '\"\""' is invalid"
how about replacing :
| where SITE=$SITE$
with this :
| search SITE="$SITE$"
Unfortunately no!
I have tested | search SITE="$SITE$"
and | search SITE="$SITE|s$"
and it doesn't works....
and if I do | search SITE=Toul*
in the drilldown it works
So let's see what's inside the "$SITE$"
, can you add $SITE$
to the title of the view ? Should show you the result it's giving on the title line 🙂
@jip31, let me know what you see for your token value
hey, I just see $SITE$
....
Then run it as the search : | makeresults | eval msg=$SITE$
it's strange, I have the field _time dispalyed!!
so this is your problem 😄 change the token name in the input and try using that, maybe you got two tokens mixed up. And make sure you have |fields yourSiteFieldName
populating the value and not just a search.
You mean something like this :
SITE=$TOTO$ | fields TOTO ??