<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Dropdown in a Form in Dashboards &amp; Visualizations</title>
    <link>https://community.splunk.com/t5/Dashboards-Visualizations/Dropdown-in-a-Form/m-p/583136#M47775</link>
    <description>&lt;P&gt;I used &amp;amp;quot; around the eval and it worked.&lt;/P&gt;</description>
    <pubDate>Mon, 31 Jan 2022 20:04:51 GMT</pubDate>
    <dc:creator>bt149</dc:creator>
    <dc:date>2022-01-31T20:04:51Z</dc:date>
    <item>
      <title>Dropdown in a Form</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Dropdown-in-a-Form/m-p/583132#M47774</link>
      <description>&lt;P&gt;I have a dashboard (form) where I have a dropdown to choose between two different types of "changes" that may have happened in one of our environments.&amp;nbsp; When one of the dropdowns is chosen, a table is populated with results.&lt;/P&gt;&lt;P&gt;The dropdown menu is configured:&lt;/P&gt;&lt;P&gt;&amp;lt;choice value="index=something blah blah blah | table 1 2 3"&amp;gt;Config Change&amp;lt;/choice&amp;gt;&lt;/P&gt;&lt;P&gt;&amp;lt;choice value="index=another_index blah blah blah | table 7 8 9"&amp;gt;Admin Change&amp;lt;/choice&amp;gt;&lt;BR /&gt;&lt;BR /&gt;The table portion is configured:&lt;/P&gt;&lt;P&gt;&amp;lt;query&amp;gt;$tok_change$&amp;lt;/query&amp;gt;&lt;/P&gt;&lt;P&gt;This all works great.&amp;nbsp; I have a need to eval a field called Name in the Config Change "choice".&amp;nbsp; This Name field will have a value of "A change to the system was made."&lt;/P&gt;&lt;P&gt;The comes in when I add the following to the SPL:&lt;BR /&gt;eval Name="A change to the system was made"&lt;/P&gt;&lt;P&gt;I receive the following message:&lt;/P&gt;&lt;P&gt;"Error on line 8: Invalid attribute name"&lt;/P&gt;&lt;P&gt;I figure it has something to do with the quote in the eval statement but I can't make this happen.&amp;nbsp; Any help / guidance is greatly appreciated.&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Mon, 31 Jan 2022 19:50:06 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Dropdown-in-a-Form/m-p/583132#M47774</guid>
      <dc:creator>bt149</dc:creator>
      <dc:date>2022-01-31T19:50:06Z</dc:date>
    </item>
    <item>
      <title>Re: Dropdown in a Form</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Dropdown-in-a-Form/m-p/583136#M47775</link>
      <description>&lt;P&gt;I used &amp;amp;quot; around the eval and it worked.&lt;/P&gt;</description>
      <pubDate>Mon, 31 Jan 2022 20:04:51 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Dropdown-in-a-Form/m-p/583136#M47775</guid>
      <dc:creator>bt149</dc:creator>
      <dc:date>2022-01-31T20:04:51Z</dc:date>
    </item>
    <item>
      <title>Re: Dropdown in a Form</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Dropdown-in-a-Form/m-p/583164#M47778</link>
      <description>&lt;P&gt;Hi&amp;nbsp;&amp;nbsp;&lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/242392"&gt;@bt149&lt;/a&gt;,&lt;/P&gt;&lt;P&gt;let me understand:&lt;/P&gt;&lt;P&gt;you use in a panel a search choosed on the drilldown, and then you want to add an eval command to the search, is it correct?&lt;/P&gt;&lt;P&gt;are you using this notation?&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;&amp;lt;query&amp;gt;
   $tok_change$
   | eval Name="A change to the system was made"
&amp;lt;/query&amp;gt;&lt;/LI-CODE&gt;&lt;P&gt;in other words, are you using the pipe before the eval command?&lt;/P&gt;&lt;P&gt;Ciao.&lt;/P&gt;&lt;P&gt;Giuseppe&lt;/P&gt;</description>
      <pubDate>Tue, 01 Feb 2022 07:05:12 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Dropdown-in-a-Form/m-p/583164#M47778</guid>
      <dc:creator>gcusello</dc:creator>
      <dc:date>2022-02-01T07:05:12Z</dc:date>
    </item>
  </channel>
</rss>

