Hi, It is actually working now. It just took about 5 minutes to run the query. I am very surprised it took that long because running the same query in a search executes fairly quickly.   Thanks for your extreme patience and assistance. Very much appreciated. ... View more

Hi,   I made those changes but still no good. I did do one thing though that proves that the code is reached. The label for the hidden multi-select was “Do not use $hiddenToken$. This did not produce a label when run.  I removed the $hiddenToken$ and rerun. The label “Do not use” was then displayed. This tells me that $hiddenToken is not being set and by definition, neither is $result.returnshards$. Current code is below.   </init>   <fieldset submitButton="true" autoRun="true">     <input type="multiselect" token="shardToken" searchWhenChanged="false">       <label>Shards</label>       <delimiter>,</delimiter>       <fieldForLabel>shardaccount</fieldForLabel>       <fieldForValue>shard</fieldForValue>       <search>         <query>| inputlookup ShardList.csv | eval shardaccount=shard + " - " + account</query>         <earliest>@d</earliest>         <latest>now</latest>       </search>       <change>         <condition match="$accountselectedToken$==&quot;True&quot;">           <set token="accountselectedToken">False</set>         </condition>         <condition>           <set token="accountToken">"*"</set>         </condition>       </change>     </input>     <input type="multiselect" token="doNotUseToken" searchWhenChanged="false">       <label>Do not use $hiddenToken$</label>       <delimiter>,</delimiter>       <fieldForLabel>$result.returnshards$</fieldForLabel>       <fieldForValue>$result.returnshards$</fieldForValue>       <search>         <query>           index=whatever shard IN ("*") | search shard!=0 AND shard!=-1           | stats count as result by shard           | sort -result           | head 5           | stats values(shard) as returnshards         </query>         <done>           <eval token="form.shardToken">$result.returnshards$</eval>           <eval token="shardToken">$result.returnshards$</eval>           <eval token="hiddenToken">mvjoin($result.returnshards$,",")</eval>         </done>         <earliest>@d</earliest>         <latest>now</latest>       </search>     </input>   ... View more

Hi, I made those changes but as shown in the attachment, no label is displayed. When the mouse hovers over it, it is not even selectable. So does that mean it is not actually executing?   ... View more

Hi, I have made all the changes. I also made the assumption that the initial search is now redundant as it has been moved to the hidden panel. The dropdown is populated successfully by the shard list, however it doesn't look like the search in the hidden dropdown executes. The panel shows "Search is waiting for input". And I did update the "whatever" index to the correct one. How can we tell if the search actually executes? Code is: <init>     <set token="accountToken">"*"</set>     <set token="accountselectedToken">False</set>   </init>   <fieldset submitButton="true" autoRun="true">     <input type="multiselect" token="shardToken" searchWhenChanged="false">       <label>Shards</label>       <delimiter>,</delimiter>       <fieldForLabel>shardaccount</fieldForLabel>       <fieldForValue>shard</fieldForValue>       <search>         <query>| inputlookup ShardList.csv | eval shardaccount=shard + " - " + account</query>         <earliest>@d</earliest>         <latest>now</latest>       </search>       <change>         <condition match="$accountselectedToken$==&quot;True&quot;">           <set token="accountselectedToken">False</set>         </condition>         <condition>           <set token="accountToken">"*"</set>         </condition>       </change>     </input>     <input type="multiselect" token="doNotUseToken" searchWhenChanged="false" depends="$alwaysHide$">       <label>Do not use</label>       <delimiter>,</delimiter>       <fieldForLabel>shardaccount</fieldForLabel>       <fieldForValue>shard</fieldForValue>       <search>         <query>           index=****** shard IN ("*") | search shard!=0 AND shard!=-1           | stats count as result by shard           | sort -result           | head 5           | stats values(shard) as returnshards         </query>         <done>           <eval token="form.shardToken">$result.returnshards$</eval>           <eval token="shardToken">$result.returnshards$</eval>         </done>         <earliest>@d</earliest>         <latest>now</latest>       </search>     </input> ... View more

It's in the code I gave you earlier but here it is again. </init>   <fieldset submitButton="true" autoRun="true">      <input type="multiselect" token="shardToken" searchWhenChanged="false">           <label>Shards</label>          <delimiter>,</delimiter>          <fieldForLabel>shardaccount</fieldForLabel>          <fieldForValue>shard</fieldForValue>      <search>          <query>| inputlookup ShardList.csv               | eval shardaccount=shard + " - " + account</query>             <earliest>@d</earliest>             <latest>now</latest>       </search> ... View more

I am pre-populating the multi-select with.a list of all available shards. The pre-query will simply assign the shards to that multi-select that it returns in the result.   In this way, initially, the multi-select will show the shards returned by the pre-query, however dropping the dropdown, they can add any other shards they may want to the list of shards to query. ... View more

That may be possible.  There is an initial pre-population of shards into the multi-select dropdown. This could affect the value of form.shardToken. I guess it depends on what happens first, the initial pre-query or the pre-population. Judging by current results I'm thinking the query runs first and the form.shardToken is overwritten by the pre-population. If that's the case, I can store the query result in a temporary token, but where do I set the form.shardToken after the pre-population? I attempted a done clause as part of the pre-population but this was not allowed and also attempted to assign in the init section.   Thanks ... View more

So what is wrong with the below code that is not populating the form.shardToken? <form theme="dark">   <label>Troubleshooting Dashboard</label>   <description>===========================================</description> <search     <query>          index=whatever shard IN ("*") | search shard!=0 AND shard!=-1         | stats count as result by shard         | sort -result         | head 5         | stats values(shard) as returnshards     </query>       <done>           <eval token="form.shardToken">$result.returnshards$</eval>       </done>  </search> ... View more

I don't see how this fixes my problem. shardToken is only set in 3 places, one from the input dropdown and 2 in drilldowns, which is appropriate.     ... View more

Ok. Full dashboard below, with all sensitive bits changed and a couple of panels removed because of 20000 ch limit. <form theme="dark">   <label>Troubleshooting Dashboard</label>   <description>==============================================================</description>   <search>     <query>       index=whatever shard IN ("*") | search shard!=0 AND shard!=-1       | chart count as result by shard       | sort -result       | head 5       | stats values(shard) as returnshards     </query>       <done>         <eval token="form.shardToken">$result.returnshards$</eval>      </done>         </search>   <init>     <set token="accountToken">"*"</set>     <set token="accountselectedToken">False</set>     <set token="shardToken">$form.shardToken$</set>   </init>   <fieldset submitButton="true" autoRun="true">     <input type="multiselect" token="shardToken" searchWhenChanged="false">       <label>Shards</label>       <delimiter>,</delimiter>       <fieldForLabel>shardaccount</fieldForLabel>       <fieldForValue>shard</fieldForValue>       <search>         <query>| inputlookup ShardList.csv | eval shardaccount=shard + " - " + account</query>         <earliest>@d</earliest>         <latest>now</latest>       </search>       <change>         <condition match="$accountselectedToken$==&quot;True&quot;">           <set token="accountselectedToken">False</set>         </condition>         <condition>           <set token="accountToken">"*"</set>         </condition>       </change>     </input>     <input type="time" token="TimeRange" searchWhenChanged="false">       <label>Time Range</label>       <default>         <earliest>-15m</earliest>         <latest>now</latest>       </default>     </input>     <input type="checkbox" token="debugToken" searchWhenChanged="true">       <label></label>       <choice value="1">Show Debug Panel</choice>     </input>   </fieldset>   <row>     <panel depends="$debugToken$">       <title>Token Debug</title>       <html>         <h2>Shard token = $shardToken$</h2>         <h2>Account token = $accountToken$</h2>         <h2>Account selected token = $accountselectedToken$</h2>                 <h2>Debug token = $debugToken$</h2>         <h2>Form token = $form.shardToken$</h2>         <h2>Returned shards = $result.returnshards$</h2>       </html>     </panel>   </row>   <row>     <panel>       <title>Events Count By Shard Descending</title>       <chart>         <search>           <query>index=whatever shard IN ($shardToken$) | search shard!=0 AND shard!=-1                  | chart count as result by shard                  | sort -result                  | head 5           </query>           <earliest>$TimeRange.earliest$</earliest>           <latest>$TimeRange.latest$</latest>         </search>         <option name="charting.axisTitleX.text">shards</option>         <option name="charting.axisTitleX.visibility">visible</option>         <option name="charting.axisTitleY.text">Event Range</option>         <option name="charting.axisTitleY.visibility">collapsed</option>         <option name="charting.chart">column</option>         <option name="charting.chart.showDataLabels">all</option>         <option name="charting.drilldown">all</option>         <option name="charting.legend.labelStyle.overflowMode">ellipsisEnd</option>         <option name="charting.legend.placement">none</option>         <option name="refresh.display">preview</option>         <drilldown>           <set token="shardToken">$click.value$</set>           <set token="form.shardToken">$click.value$</set>         </drilldown>       </chart>     </panel>     <panel>       <title>Accounts</title>       <table>         <search>           <query>index=whatever shard IN ($shardToken$) | search shard!=0 AND shard!=-1  | spath account  | search account=$accountToken$ | where account!=0  | top limit=5 account by shard | sort - count</query>           <earliest>$TimeRange.earliest$</earliest>           <latest>$TimeRange.latest$</latest>         </search>         <option name="drilldown">cell</option>         <drilldown>           <set token="form.shardToken">$click.value$</set>           <set token="shardToken">$click.value$</set>           <set token="accountToken">$click.value2$</set>           <set token="accountselectedToken">True</set>         </drilldown>       </table>     </panel>     <panel>       <title>Endpoints</title>       <chart>         <search>           <query>index=whatever shard IN ($shardToken$) | search shard!=0 AND shard!=-1  | chart count by endpoint | sort - count | head 5</query>           <earliest>$TimeRange.earliest$</earliest>           <latest>$TimeRange.latest$</latest>         </search>         <option name="charting.axisTitleX.visibility">collapsed</option>         <option name="charting.axisTitleY.visibility">collapsed</option>         <option name="charting.axisTitleY2.visibility">visible</option>         <option name="charting.chart">column</option>         <option name="charting.chart.showDataLabels">all</option>         <option name="charting.chart.stackMode">default</option>         <option name="charting.drilldown">none</option>         <option name="charting.legend.placement">none</option>         <option name="refresh.display">progressbar</option>         <option name="trellis.enabled">0</option>         <option name="trellis.scales.shared">0</option>         <option name="trellis.size">small</option>         <option name="trellis.splitBy">_aggregation</option>       </chart>     </panel>   </row>   <row>     <panel>       <title>Top 5 External IP Addresses</title>       <chart>         <search>           <query>index=whatever shard IN ($shardToken$) | search shard!=0 AND shard!=-1 NOT (original_ip=“123456789”) NOT (original_ip="-") NOT (original_ip=“123456789”)  | timechart limit=5 count by original_ip useother=f | sort - count</query>           <earliest>$TimeRange.earliest$</earliest>           <latest>$TimeRange.latest$</latest>         </search>         <option name="charting.axisTitleX.text">@timestamp by 30 minutes</option>         <option name="charting.chart">line</option>         <option name="charting.drilldown">none</option>         <option name="refresh.display">progressbar</option>       </chart>     </panel>     <panel>       <title>Top 5 IP External Addresses Word Count</title>       <table>         <search>           <query>index=whatever shard IN ($shardToken$) | search shard!=0 AND shard!=-1 NOT (original_ip=“123456789”) NOT (original_ip="-") NOT (original_ip=“123456789”)  | top limit=5 original_ip  | sort - count</query>           <earliest>$TimeRange.earliest$</earliest>           <latest>$TimeRange.latest$</latest>         </search>         <option name="drilldown">none</option>         <option name="refresh.display">progressbar</option>         <option name="wrap">true</option>       </table>     </panel>   </row> </form> ... View more

I attempted to change set to eval with no luck. I can provide the whole dashboard if you think it would help, but  I see the issue in the <done> handler.  The query is fine as I can run it successfully in a search window, so there is a disconnect between the query statement : | stats values(shard) as returnshards and  <done>        <eval token="form.shardToken">$result.returnshards$</eval> </done>   if you need the full dashboard, please let me know. Thanks   ... View more

Thanks very much for your help so far. I have made the changes and all warnings have cleared. But no data is returned. When I run the search in a search window, it DOES return the top 5 shards. So something in the return assignment is not right. Code looks like this: <form theme="dark">      <label>Troubleshooting Dashboard</label      <description>=======================================================</description>   <search>       <query>              index=whatever shard IN ("*")              | chart count as result by shard              | sort -result              | head 5              | stats values(shard) as returnshards        </query>              <done>                       <eval token="form.shardToken">$result.returnshards$</eval>              </done>         </search>           <init>                 <set token="accountToken">"*"</set>                 <set token="accountselectedToken">False</set>                 <set token="shardToken">$form.shardToken$</set>          </init> <fieldset submitButton="true" autoRun="true">   ... View more

Ok, I've done that but am receiving a warning as shown in the screenshot. Is "init" a good place for the search and where should the done handler exist? Thanks   ... View more

When the dashboard first runs, it checks all databases and returns the top 5. I want the list of databases returned set to the dropdown form.shardToken as if they had been selected by the user and the actual token, shardToken, also set to the same returned list.     ... View more

Thanks very much. All is working. Can't believe it was that simple. ... View more

Ok, I have set the Match statement to look like this. <condition match="$accountselectedToken$=='True'"> It still does not recognise the match condition.   The accountselectedToken is set when I click on the account value in the Accounts panel. It is a drilldown. This then changes the dropdown panel to the shard value the account is on thus invoking the change condition, but it still sets the accountToken to "*". The Match condition is still failing. When I mentioned unset, I actually meant set the value to False. ... View more

Initially it is set here when the dashboard loads. <init>     <set token="accountToken">"*"</set>     <set token="accountselectedToken">False</set> </init> There is an Accounts panel that displays the top performing account for each shard. When clicking on the account I want, the accountselectedToken is set to True. This is because I also update the Shards multi-select box with the Shard the account is on. So in this changed condition, I don't want to set the accountToken to "*". I simply want to unset the accountselectedToken. accountselectedToken is not a string value.  ... View more

Quick explanation of the issue. I actually over complicated the problem when it was very simple. I needed to show endpoint response times over am 99% percentile of servtime, which is the length of time of the transaction. In the end it was a very easy query.  Set up your search and filters and the timechart line looks like this. timechart p99(servetime) by endpoint Thanks ... View more

Hi, Aplologies. In my frustration I did not articulate fully. I have actually figured it out now. Thanks for your time. ... View more