Dashboards & Visualizations

Why are changes based on drop-down input in panels not updating in the following dashboard?

Kendo213
Communicator

The following dashboard is not updating panels when a different option is selected in the drop-down. It only works on initial load -- any ideas? Is there a way to trigger the base search to run again if a drop-down input is changed?

<form>
  <label>Azure Billing</label>
  <search id="basebillingsearch">
    <query>index=test sourcetype=azure:billing | fields *</query>
    <earliest>$earliestdate$</earliest>
    <latest>now</latest>
  </search>
  <fieldset submitButton="false">
    <input type="dropdown" token="billingperiodselected" searchWhenChanged="true">
      <label>Billing Period</label>
      <fieldForLabel>billingperiod</fieldForLabel>
      <fieldForValue>billingperiod</fieldForValue>
      <search>
        <query>index=test sourcetype=azure:billing | rex field=properties.billingPeriodId (?:\/subscriptions\/oursubid\/providers\/Microsoft\.Billing\/billingPeriods\/)(?<billingperiod>\d+) | rex field=billingperiod (?<year>\d{4})(?<month>\d{2})(?<day>\d{2}) | eval earliestdate=month."/".day."/".year." 00:00:00" | eval earliestdate = strptime('earliestdate', "%m/%d/%Y %H:%M:%S") | dedup billingperiod | fields * </query>
        <done>
          <set token="earliestdate">$result.earliestdate$</set>
        </done>
      </search>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>Overall Azure Cost for billing period</title>
      <chart>
        <search base="basebillingsearch" depends="$billingperiodselected$" >
          <query>| timechart sum("properties.pretaxCost") span=1d | rename "sum(properties.pretaxCost)" as "Azure Cost (US)"</query>
        </search>
        <option name="charting.chart">line</option>
      </chart>
    </panel>
    <panel>
      <title>Overall Azure Cost by Azure Service (Top 10)</title>
      <chart>
        <search base="basebillingsearch">
          <query>| timechart sum("properties.pretaxCost") span=1d by "properties.consumedService" limit=10 useother=f | rename "sum(properties.pretaxCost)" as "Azure Cost (US)"</query>
        </search>
        <option name="charting.chart">line</option>
      </chart>
    </panel>
        <panel>
      <title>Total Cost for Billing Period</title>
      <table>
        <search base="basebillingsearch">
          <query>|stats sum("properties.pretaxCost") as "Azure Total Cost (US)" | eval "Azure Total Cost (US)"=round('Azure Total Cost (US)',2)</query>
        </search>
        </table>
    </panel>
  </row>
</form>
0 Karma

TISKAR
Builder

Hi,

Can you try this, i add billingperiodselected field to detect change :

<form>
   <label>Azure Billing</label>
   <search id="basebillingsearch">
     <query>index=test sourcetype=azure:billing | **eval billingperiodselected="$billingperiodselected$"** | fields *</query>
     <earliest>$earliestdate$</earliest>
     <latest>now</latest>
   </search>
   <fieldset submitButton="false">
     <input type="dropdown" token="billingperiodselected" searchWhenChanged="true">
       <label>Billing Period</label>
       <fieldForLabel>billingperiod</fieldForLabel>
       <fieldForValue>billingperiod</fieldForValue>
       <search>
         <query>index=test sourcetype=azure:billing | rex field=properties.billingPeriodId (?:\/subscriptions\/oursubid\/providers\/Microsoft\.Billing\/billingPeriods\/)(?<billingperiod>\d+) | rex field=billingperiod (?<year>\d{4})(?<month>\d{2})(?<day>\d{2}) | eval earliestdate=month."/".day."/".year." 00:00:00" | eval earliestdate = strptime('earliestdate', "%m/%d/%Y %H:%M:%S") | dedup billingperiod | fields * </query>
         <done>
           <set token="earliestdate">$result.earliestdate$</set>
         </done>
       </search>
     </input>
   </fieldset>
   <row>
     <panel>
       <title>Overall Azure Cost for billing period</title>
       <chart>
         <search base="basebillingsearch" depends="$billingperiodselected$" >
           <query>| timechart sum("properties.pretaxCost") span=1d | rename "sum(properties.pretaxCost)" as "Azure Cost (US)"</query>
         </search>
         <option name="charting.chart">line</option>
       </chart>
     </panel>
     <panel>
       <title>Overall Azure Cost by Azure Service (Top 10)</title>
       <chart>
         <search base="basebillingsearch">
           <query>| timechart sum("properties.pretaxCost") span=1d by "properties.consumedService" limit=10 useother=f | rename "sum(properties.pretaxCost)" as "Azure Cost (US)"</query>
         </search>
         <option name="charting.chart">line</option>
       </chart>
     </panel>
         <panel>
       <title>Total Cost for Billing Period</title>
       <table>
         <search base="basebillingsearch">
           <query>|stats sum("properties.pretaxCost") as "Azure Total Cost (US)" | eval "Azure Total Cost (US)"=round('Azure Total Cost (US)',2)</query>
         </search>
         </table>
     </panel>
   </row>
 </form>
0 Karma

gaurav_maniar
Builder

Hi,

I have checked your dashboard XML, the token billingperiodselected is not being used in search query.
Hence you will see no updates on the dashboard after changing the value from the dropdown.

The toke is being used for the depends parameter for a search tag.
depends is used to dynamically manage visibility of any panel in the dashboard. It has nothing to do with the value of the token.
Also, using it with search tag doesn't make any sense. If you want to change the results the token should be used in search query.

For more details, refer the following documentation.
https://docs.splunk.com/Documentation/Splunk/8.0.1/Viz/ContextualDrilldown#Show_or_hide_content

accept and upvote the answer if it helps.

0 Karma

chiennylin
New Member

I'm having the same issue.
when I updated the form inputs, my panel search is not refreshing.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

REGISTER NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If ...

Observability | Use Synthetic Monitoring for Website Metadata Verification

If you are on Splunk Observability Cloud, you may already have Synthetic Monitoringin your observability ...

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...