update dashboard table after changes in filters

[SplunkySplunk]

Hello

I have  a dashboard with few panels
All the panels have drilldown tokens that updates a table
also, i have few filters that supposed to update the table also but i see a message " Search is waiting for input..." when selecting options from the filters. 
The tables updated only when clicking on the other panels.

how can i update the table from the filters ?

Thanks

[ITWhisperer]

You could try setting initial / default values for the filters

Other than that, you may have to share the source of your dashboard for us to be able to suggest changes.

[sarit_s]

Hello

Each filter have default value "*"
this is an example for the source of 2 filters :

   <input type="multiselect" token="Account_Label_Azure">
      <label>Account Label Azure</label>
      <choice value="*">ALL</choice>
      <default>*</default>
      <fieldForLabel>Account_Label_Azure</fieldForLabel>
      <fieldForValue>Account_Label_Azure</fieldForValue>
      <search>
        <query>index=report Account_Label_Azure=*</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
    </input>
    <input type="multiselect" token="Account_Label_VMware">
      <label>Account Label VMware</label>
      <choice value="*">ALL</choice>
      <default>*</default>
      <fieldForLabel>Account_Label_VMware</fieldForLabel>
      <fieldForValue>Account_Label_VMware</fieldForValue>
      <search>
        <query>index=report Account_Label_VMware=*</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>

and this is the source of the table 

      <table>
        <search>
          <query>index="report"  Category__Severities_of_Patches="$host1$" OR Category__Categories_of_Patches="$host2$" OR   Category__Sources_of_Patches="$host3$" OR exposure_level=$host_exposure_level$ OR Computer_Name="$computer_name$" OR  Account_Label_Azure="$Account_Label_Azure$" OR Account_Label_VMware="$Account_Label_VMware$" OR BigFix_Groups="$BigFix_Groups$" OR      Category__Sources_of_Patches="$Category__Sources_of_Patches$" OR  Custom_Attributes="$Custom_Attributes$" OR Custom_Site_Names="$Custom_Site_Names$" OR IP_Address="$IP_Address$" OR Operating_System="$Operating_System$" OR OS="$OS$" OR Pending_Restart="$Pending_Restart$" OR Power_State_VMware="$Power_State_VMware$" OR Provider_Name="$Provider_Name$" OR Relay="$Relay$" OR State_Azure="$State_Azure$" OR VM_Region="$VM_Region$" OR Tags_Azure___cost_environment=$Tags_Azure___cost_environment$ OR Tags_Azure___cost_servicegroup=$Tags_Azure___cost_servicegroup$ OR Tags_Azure___cost_team=$Tags_Azure___cost_team$ OR  Custom_Attributes=$Custom_Attributes$
| table Computer_ID Computer_Name Account_Label_VMware Account_Label_Azure Provider_Name OS Relay VMware_Tags Tags_Azure Custom_Site_Names Pending_Restart Custom_Attributes Last_Report_Time Last_Updated Free_Space_on_System_Drive_(GB) Power_State_VMware State_Azure BigFix_Groups Category__Names_of_Patches Category__Severities_of_Patches Category__Categories_of_Patches Category__Sources_of_Patches Category__CVEs_of_Patches Category__Release_Dates_of_Patches</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>

[ITWhisperer]

Try this

   <input type="multiselect" token="Account_Label_Azure">
      <label>Account Label Azure</label>
      <choice value="*">ALL</choice>
      <initialValue>*</initialValue>
      <default>*</default>
      <fieldForLabel>Account_Label_Azure</fieldForLabel>
      <fieldForValue>Account_Label_Azure</fieldForValue>
      <search>
        <query>index=report Account_Label_Azure=*</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
    </input>
    <input type="multiselect" token="Account_Label_VMware">
      <label>Account Label VMware</label>
      <choice value="*">ALL</choice>
      <initialValue>*</initialValue>
      <default>*</default>
      <fieldForLabel>Account_Label_VMware</fieldForLabel>
      <fieldForValue>Account_Label_VMware</fieldForValue>
      <search>
        <query>index=report Account_Label_VMware=*</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>

Having said that, you have these as multiselects which won't work very well in your search if more than one value is selected.

[sarit_s]

ok, i found the problem

one of the panels that updates the table is trellis_pie and this token is the one that brakes every thing

so i guess i configured it wrong

what is the right way to configure trellis_pie token ?

this is the source:

    <panel>
      <chart id="trellis_pie">

        <option name="charting.axisTitleX.visibility">collapsed</option>
        <option name="charting.axisTitleY.visibility">collapsed</option>
        <option name="charting.axisTitleY2.visibility">collapsed</option>
        <option name="charting.chart">pie</option>
        <option name="charting.chart.sliceCollapsingThreshold">0</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.legend.placement">none</option>
        <option name="refresh.display">progressbar</option>
        <option name="trellis.enabled">1</option>
        <drilldown>
          <set token="host_exposure_level">$row.category$</set>
        </drilldown>
      </chart>
    </panel>

[ITWhisperer]

What is your search?

[sarit_s]

Hello

i've tried to add * as the initial value

but its not working

in default initial value ignored once default value is configured.  

[ITWhisperer]

You are right - default overwrites initial. So, the missing tokens may be somewhere else in your filters.

[sarit_s]

ok, i found the problem

one of the panels that updates the table is trellis_pie and this token is the one that brakes every thing

so i guess i configured it wrong

what is the right way to configure trellis_pie token ?

this is the source:

<option name="charting.axisTitleX.visibility">collapsed</option>
        <option name="charting.axisTitleY.visibility">collapsed</option>
        <option name="charting.axisTitleY2.visibility">collapsed</option>
        <option name="charting.chart">pie</option>
        <option name="charting.chart.sliceCollapsingThreshold">0</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.legend.placement">none</option>
        <option name="refresh.display">progressbar</option>
        <option name="trellis.enabled">1</option>
        <drilldown>
          <set token="host_exposure_level">$row.category$</set>
        </drilldown>
      </chart>