topic Re: Dropdown in Dashboard Only Showing One Word Results in Getting Data In

Why is Dropdown in Dashboard Only Showing One Word Results?

ryanadamski — Thu, 28 Jul 2022 14:48:47 GMT

Hello,

Anyone have any idea why a dropdown filter would only show results for one word field result? I need the dropdown to work with field results of more than one word.

Re: Dropdown in Dashboard Only Showing One Word Results

bowesmana — Wed, 27 Jul 2022 22:43:26 GMT

Need as little more information to work with here...

I am guessing that this could be something to do with quoting, i.e. if you want to search for a drop down phrase

hello world

and your token is my_choice, then in your search, if you are using

search... my_field=$my_choice$

then Splunk will be searching

my_field=hello world

and you want it to search

my_field="hello world"

so to do that, you should use the |s token suffix, which instructs Splunk to quote the result, i.e.

search... my_field=$my_choice|s$

Re: Dropdown in Dashboard Only Showing One Word Results

ryanadamski — Thu, 28 Jul 2022 14:29:57 GMT

bowesmana,

Thanks for the solution. Worked like a charm!