Geostats token passed to dropdown doesn't change a...

johnansett · ‎06-01-2018

I have a dashboard which starts with just a map, the idea is that by clicking on the cluster it will pass a token to a (hidden) dropdown box which then passes token to power some single values, this way I can pass the location to several searches (if there is a better way to do this the please let me know!!).

<form stylesheet="custom_decorations.css, latlon.css" script="tokenlinks.js">
  <label>Dashboard v2</label>
  <search id="COMPUTE_BY_LOCATION" ref="COMPUTE_BY_LOCATION">
    <earliest>-12h</earliest>
    <latest>now</latest>
  </search>
  <description>Dashboard</description>
  <fieldset submitButton="false">
    <input type="dropdown" token="location" searchWhenChanged="true">
      <label>Location</label>
      <search>
        <query>| inputlookup location | table Longitude Latitude Location  | search Latitude &gt;= $s$ Latitude &lt; $n$ Longitude &gt;= $w$ Longitude &lt; $e$ | head 1 | table Location</query>
      </search>
      <fieldForLabel>Location</fieldForLabel>
      <fieldForValue>Location</fieldForValue>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>Core and Memory Count by Location</title>
      <map>
        <search>
          <query>
          index=summary
          | lookup location_v2 Location AS Location
          | stats count by vCores, vMemoryGB, vm_name, Location, Latitude, Longitude
          |  geostats latfield=Latitude longfield=Longitude globallimit=0 sum(vCores) AS "Cores", sum(vMemoryGB) AS "RAM" BY Location
          </query>
        </search>
        <option name="drilldown">all</option>
        <option name="mapping.choroplethLayer.colorBins">5</option>
        <option name="mapping.choroplethLayer.colorMode">auto</option>
        <option name="mapping.choroplethLayer.maximumColor">0xDB5800</option>
        <option name="mapping.choroplethLayer.minimumColor">0x2F25BA</option>
        <option name="mapping.choroplethLayer.neutralPoint">0</option>
        <option name="mapping.choroplethLayer.shapeOpacity">0.75</option>
        <option name="mapping.choroplethLayer.showBorder">1</option>
        <option name="mapping.data.maxClusters">10000</option>
        <option name="mapping.legend.placement">bottomright</option>
        <option name="mapping.map.center">(39.833333,-98.583333)</option>
        <option name="mapping.map.panning">1</option>
        <option name="mapping.map.scrollZoom">0</option>
        <option name="mapping.map.zoom">4</option>
        <option name="mapping.markerLayer.markerMaxSize">50</option>
        <option name="mapping.markerLayer.markerMinSize">10</option>
        <option name="mapping.markerLayer.markerOpacity">0.8</option>
        <option name="mapping.showTiles">1</option>
        <option name="mapping.tileLayer.maxZoom">9</option>
        <option name="mapping.tileLayer.minZoom">0</option>
        <option name="mapping.tileLayer.tileOpacity">1</option>
        <option name="mapping.type">marker</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
        <drilldown>
          <set token="n">$click.bounds.north$</set>
          <set token="s">$click.bounds.south$</set>
          <set token="e">$click.bounds.east$</set>
          <set token="w">$click.bounds.west$</set>
        </drilldown>
      </map>
      <html>
           <button class="btn" data-unset-token="n">Hide Fields</button>
      </html>
    </panel>
  </row>
  <row depends="$n$">
    <panel>
      <search base="COMPUTE_BY_LOCATION">
        <query>
          | search Location="$location$" | rangemap field=CPU_Capacity low=0-49 elevated=50-79 severe=80-99
        </query>
        <preview>
          <set token="cpu_value">$result.CPU_Capacity$</set>
          <set token="cpu_range">$result.range$</set>
        </preview>
      </search>
      <title>$location$ CPU Core Utilisation</title>
      <html>
           <div class="custom-result-value $cpu_range$">
             $cpu_value$
            </div>
            <p align="middle">CPU Core Capacity (% Used)</p>
            <button class="btn" data-set-token="cpu_chart" data-value="show">Show Chart</button>
            </html>
    </panel>
  </row>
</form>

This will work great on the first click: I can click a cluster and it will show the row (token $n$) and pass n,e,s,w tokens to the dropdown which will then show the location and pass the $location$ token along to the panel. The problem is if I then click another cluster on the map, it doesn't update the drop down again. I un-hid the dropdown and I can see what happens, essentially the value is there, available now but you need to drop it down to select it. I would like this to be seamless and not require anyone even seeing the hidden dropdown/search.

Interested to see if / how this can be done best!

Thanks!

Geostats token passed to dropdown doesn't change after the first time it is clicked

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

They're back! Join the SplunkTrust and MVP at .conf24

Enterprise Security Content Update (ESCU) | New Releases