Dashboard Studio Multiselect with dynamic items and wrong search pattern / missing quotes?

bauera-hk — Thu, 15 Dec 2022 16:46:14 GMT

Hi there,

i'm a new splunk user and try to use the new Dashboard Studio variant of dashboards like the last example described here: https://docs.splunk.com/Documentation/Splunk/8.2.4/DashStudio/inputs#Example:_Search-based_cascading_inputs

My Problem is the values for the dynamic multiselect input have whitespaces in it and as soon as i use the "IN" operator in the search query this retruns no entries. If i manually change the search query and put all the values in quotes it is working as expected. Is there any way to do this in the definition of the input?

I can also append a

eval appDisplayName = \"\\\"\".appDisplayName.\"\\\"\"

to the ds.search query but this also adds the quotes to the display portion.

My complete json looks like this:

{ "visualizations": { "viz_hSyaQ4tf": { "type": "splunk.table", "options": {}, "dataSources": { "primary": "ds_saMdKSzT" } } }, "dataSources": { "ds_saMdKSzT": { "type": "ds.search", "options": { "query": "sourcetype=\"azure:aad:signin\" userPrincipalName=$userPrincipalName$ AND appDisplayName IN ($appDisplayName$) | table createdDateTime userPrincipalName userId appDisplayName appId resourceDisplayName resourceId conditionalAccessStatus status.errorCode", "queryParameters": { "latest": "$global_time.latest$", "earliest": "$global_time.earliest$" } }, "name": "SignIns" }, "ds_XdUxasDT": { "type": "ds.search", "options": { "query": "sourcetype=\"azure:aad:signin\" | stats count by userPrincipalName", "queryParameters": { "latest": "$global_time.latest$", "earliest": "$global_time.earliest$" } }, "name": "userPrincipalName-stats" }, "ds_GQslD2fp": { "type": "ds.search", "options": { "query": "sourcetype=\"azure:aad:signin\" userPrincipalName=$userPrincipalName$ | stats count by appDisplayName", "queryParameters": { "latest": "$global_time.latest$", "earliest": "$global_time.earliest$" } }, "name": "appDisplayName-stats" } }, "defaults": { "dataSources": { "ds.search": { "options": { "queryParameters": { "latest": "$global_time.latest$", "earliest": "$global_time.earliest$" } } } } }, "inputs": { "input_global_trp": { "type": "input.timerange", "options": { "token": "global_time", "defaultValue": "-24h@h,now" }, "title": "Global Time Range" }, "input_hcQWlw8q": { "title": "Select App", "type": "input.multiselect", "options": { "items": ">frame(label, value) | prepend(formattedStatics) | objects()", "token": "appDisplayName" }, "dataSources": { "primary": "ds_GQslD2fp" }, "context": { "formattedConfig": { "number": { "prefix": "" } }, "formattedStatics": ">statics | formatByType(formattedConfig)", "statics": [ [ "All" ], [ "*" ] ], "label": ">primary | seriesByName(\"appDisplayName\") | renameSeries(\"label\") | formatByType(formattedConfig)", "value": ">primary | seriesByName(\"appDisplayName\") | renameSeries(\"value\") | formatByType(formattedConfig)" } }, "input_E26xAMU9": { "options": { "defaultValue": "user@domain.com", "token": "userPrincipalName" }, "title": "Select User", "type": "input.text" } }, "layout": { "type": "grid", "options": {}, "structure": [ { "item": "viz_hSyaQ4tf", "type": "block", "position": { "x": 0, "y": 0, "w": 1200, "h": 400 } } ], "globalInputs": [ "input_global_trp", "input_E26xAMU9", "input_hcQWlw8q" ] }, "description": "", "title": "Azure AD SignIns" }

This produces the not working query like this:

sourcetype="azure:aad:signin" userPrincipalName=bauera@herrenknecht.com AND appDisplayName IN (Microsoft Office 365 Portal,Windows Sign In,Office365 Shell WCSS-Client) | table createdDateTime userPrincipalName userId appDisplayName appId resourceDisplayName resourceId conditionalAccessStatus status.errorCode

I want it to be like this:

sourcetype="azure:aad:signin" userPrincipalName=bauera@herrenknecht.com AND appDisplayName IN ("Microsoft Office 365 Portal","Windows Sign In","Office365 Shell WCSS-Client") | table createdDateTime userPrincipalName userId appDisplayName appId resourceDisplayName resourceId conditionalAccessStatus status.errorCode

Thanks for your help.

Greetings

Andreas

Re: Dashboard Studio Multiselect with dynamic items and wrong search pattern / missing quotes

Lucas_Stern — Wed, 26 Jan 2022 21:25:13 GMT

Hi,

I had the same problem than you, and fixed it doing a escape of the values in the multiselect.

If you open the multiselect configs, there`s these two fields:

The first one is the value that will be show to the user, and the second one will be the value selected used on the token. With that in mind, I escaped the field that I want to use ("Sistema" ) to another field (Sistema_escape) and select each like the image above.

Re: Dashboard Studio Multiselect with dynamic items and wrong search pattern / missing quotes

mleati — Thu, 15 Dec 2022 16:31:43 GMT

I have been unable to find an elegant solution for this issue (it looks like Dashboard Studio is not quite "there" yet) but the following technique does work.

1. Modify data source query by adding a new field:

| eval q_appDisplayName = "\"" . appDisplayName . "\""

2. Modify input definition as follows:

"input_hcQWlw8q": {
"title": "Select App",

"type": "input.multiselect",

"options": {

"token": "appDisplayName"

"defaultValue": "*",

"clearDefaultOnSelection": true,

"items": [

{

"value": "*",

"label": "All"

}

]

"dataSources": {

"primary": "ds_GQslD2fp"

"encoding": {

"value": "primary.q_appDisplayName",

"label": "primary.appDisplayName"

}

Re: Dashboard Studio Multiselect with dynamic items and wrong search pattern / missing quotes?

oovidiu — Tue, 07 Nov 2023 07:53:01 GMT

For whoever else that needs this: your search field IN ... will accept this multivalue token passed to it:

$your_multivalue_select_tokenhere_that_also_accepts_*_as_default|s$

topic Dashboard Studio Multiselect with dynamic items and wrong search pattern / missing quotes? in Dashboards & Visualizations

Dashboard Studio Multiselect with dynamic items and wrong search pattern / missing quotes?

Re: Dashboard Studio Multiselect with dynamic items and wrong search pattern / missing quotes

Re: Dashboard Studio Multiselect with dynamic items and wrong search pattern / missing quotes

Re: Dashboard Studio Multiselect with dynamic items and wrong search pattern / missing quotes?