topic Re: Dashboard adds space to input in Dashboards & Visualizations

Why does my Dashboard add space to input?

jkordis — Wed, 26 Oct 2022 15:41:16 GMT

Hi all,

I have a dropdown menu where I select from a list of networks and then I want to update my dashboard graph based off the selected dropdown.

I have the dropdown configured and the token to reference is input. I followed the instructions and in the search on the table I have something along the lines of

| search "Network" = "$input$"

Now the crazy part to me is that this partially works. If I have a network called "Campus" that I want to search the $input$ is replaced, but it doesn't work. When I click run search I found this, the $input$ isn't being replaced by "Campus" it's being replaced by "C a m p u s" and adding spaces between each character.

Does anyone have any clue as to how to fix this? if not, how to remove the spaces so I can manually change it?

Re: Dashboard adds space to input

Sukisen1981 — Wed, 21 Aug 2019 18:47:39 GMT

hi @jkordis
The issue seems to be with your input dropdown search
see this

| makeresults
| eval Description="C a m p u s"
|eval Description=replace(Description," ","")

Inside the search for the dropdown(edit token) instead of the hard coded field here, use the field you are referring to from the $input$ token. For some reason it is being taken as space

Re: Dashboard adds space to input

jkordis — Wed, 21 Aug 2019 19:03:08 GMT

I don't think the issue is with the dropdown, otherwise why would all the selections in the list populate properly? My dropdown config looks like this

Label: Network Name
Token: input
Dynamic Options

index="aws-lambda" Subject="Network List Pulled"
| rename "MessageAttributes.NetworkName.Value" as "Network"
| stats count by "Network" | dedup "Network"

this outputs a list of all the networks and removes the duplicate instances properly, then gives me a list that pops down with the following items

Campus
Office
Boston
Lowell
Hospital

Field for Label: Network
Field for Value: Network

then in the search for the chart I have tried the replace as you suggested but it didn't take. Not really sure what to make of it

Re: Dashboard adds space to input

Sukisen1981 — Wed, 21 Aug 2019 19:09:44 GMT

not in the search for the chart, replace it in the search for the dropdown
if Network is your dropdowb field (and replace "Network" by Network) and below is your dropdown search , then:
index="aws-lambda" Subject="Network List Pulled"
| rename "MessageAttributes.NetworkName.Value" as Network|eval Network=replace(Network," ","")
| stats count by Network | dedup Network

Re: Dashboard adds space to input

jkordis — Wed, 21 Aug 2019 19:15:30 GMT

in my search for the chart would I still be referencing $input$ for the parameter being passed? I tried what you put above but didn't have any luck, when the search for the chart came into play, it was still spaced out

Re: Dashboard adds space to input

Sukisen1981 — Wed, 21 Aug 2019 19:22:44 GMT

you would, the way i see it input is your token name which gets field label and field value from Network, right?
one option you can try in the search is to replace $input$.
remove all code and see if something like this in the chart search works |makeresults| |eval z=replace("$input$," ","")|table z
so z here should have no gaps between letters....

Re: Dashboard adds space to input

Sukisen1981 — Sat, 24 Aug 2019 07:50:56 GMT

hi @jkordis
Did you try this?

Re: Dashboard adds space to input

woodcock — Mon, 02 Sep 2019 01:56:35 GMT

Try using the |n token filter:
https://docs.splunk.com/Documentation/Splunk/7.3.1/Viz/tokens#Token_filters

Re: Dashboard adds space to input

JWBailey — Wed, 26 Oct 2022 15:39:46 GMT

I was having the exact same problem described here, spaces added in between every character that was being passed into a search from a token. I resolved this problem by looking at the XML source of the dashboard, where I found an option had somehow been added to the input that was adding a space as a "delim" character. I don't have the exact syntax of the option that was added because I deleted it and saved before I thought to copy it. But this fixed my problem.

So... check your dashboard source code to make sure there aren't any options out of place.