My template parameters don't work

Comments

6 comments

  • Avatar
    Rick Jury

    Hi Debashish,

    if you are using the 'where matches ...' syntax there are a few things that can trip you up:

    1. it's case sensitive so where matches "FooABC" will not match organzition id "fooabc"

    2. * is the wildcard if you don't have an exact match so if you are using part of an id make sure to use *value* as your parameter value.

     

    It's also worth checking the parameter type of your template parameter - if it's string it will finish up in the query as "something", but you chose say keyword or any it will look different.

     

    If I was doing this type of query I would do this:

    ((_sourceCategory=mySource*)
    AND _sourcecategory = "mySourceCategory") 

    // this is searched as a keyword very quickly in your search using sumo bloom filter and is not case sensitive
    {{organization}}
    AND "myApplication""|parse "partitionKey=*," as OrgId

    // this is matches regex. it's an expensive search but will perform well as the value above excluded most events already

    // the i regular expression modifier makes it case insensitive matching.

    | where OrgId matches /(?i){{organization}}/

    0
    Comment actions Permalink
  • Avatar
    Training User123

    Hi Rick,

       Thanks for your reply . I tried with {{organization}} in the beginning of the query as well but still result is the same . It only considers the orgId that I specify in the default value . The same value when put inside the text list is not considered ..

    0
    Comment actions Permalink
  • Avatar
    Rick Jury

    my suggestions to help troubleshoot a dashboard with search templates like this would be:

    1. make sure to hit return in the filter box after updating any values. the dashboard form does not have a submit button so changes only apply after you hit return. That could be why you are not seeing changes

    2. refresh the form in your browser (e.g command R of mac) and try updating it again. Sometimes if you have been editing a dashboard you might need to refresh to get correct behaviour

    3. if you have multiple panels and made a lot of changes the dashboard can get corrupted in rare cases. To help with that you are best to log a ticket with the helpdesk, but you can also export the dashboard config and check for example that all the panels reference the correct filter ids. https://help.sumologic.com/05Search/Library/Export-and-Import-Content-in-the-Library

    0
    Comment actions Permalink
  • Avatar
    Training User123

    I actually tried even opening and running the query in the new browser and it keeps neglecting all items in the list . But does accept the values that I provide as default. So it means it is taking my changes that I am doing in the Manage Parameter Settings pop up. But it is disregarding the items that I put in the list for TextEntry . I tried with a single item , a single item with an explicit Enter in the end to add a new line and multiple entries . In any case it is not taking the items from the list . Is there some bug with the latest sumo version for template parameters ?

    0
    Comment actions Permalink
  • Avatar
    Debashish Ghosh

    Any help on this ? Has anybody tried parameterized query and can give an example .

    0
    Comment actions Permalink
  • Avatar
    Rick Jury

    Hi Debashish, 

    I'd suggest you log a support ticket https://support.sumologic.com/hc/en-us/requests/new

    I'm sure our support team could identify where you are going wrong very quickly as you can enable them access to login and view your query (by sharing the link). I think it's probably a problem with the way your template / dashboard is setup and it's hard to identify the exact problem without logging in to your sumo instance.

    0
    Comment actions Permalink

Please sign in to leave a comment.