topic Splunk dashboard drop-down menu has spaces in the values, causing the dashboard to not be able to retrieve data. in Dashboards & Visualizations

Splunk dashboard drop-down menu has spaces in the values, causing the dashboard to not be able to retrieve data.

Maximussss — Thu, 02 Nov 2023 13:43:58 GMT

I'm trying to create own Splunk (dashboard) queries for Okta data analysis. I'm having issues because a specific field has a space in the value and it's causing the dashboard to not be able to retrieve data (when I know there is data). 3 other drop-down menus work fine (there is no spaces in the values there). My main suspicion that the reason of failure is because of that spaces.
I'm trying to transform the values and remove spaces, in the hope that would help.

I Found some recommendations online and examples of functions, but I'm not very experienced with Splunk, can anyone explain step by step how I could solve that issue? If the name of my field with issues is "actor.displayName" (it has multiple spaces in the values).

Examples found online:
1) | rex mode=sed field=A "s/ //g"

2) | eval nospace=trim(A)

3)| rex field=field1 "(?<newfield>\S+)"

4)|eval NewField=trim(OldField)

Has anyone encountered this issue before? Thanks for help!

Re: Splunk dashboard drop-down menu has spaces in the values, causing the dashboard to not be able to retrieve data.

ITWhisperer — Thu, 02 Nov 2023 14:28:46 GMT

Rather than trying to remove the spaces, why not consider wrapping the value in quotes where it is used

$token_name|s$

https://docs.splunk.com/Documentation/Splunk/9.1.1/Viz/tokens#Token_filters

Re: Splunk dashboard drop-down menu has spaces in the values, causing the dashboard to not be able to retrieve data.

Maximussss — Thu, 02 Nov 2023 15:10:14 GMT

Thank you for your advice, in this case if my token name is for example "actor.displayName"

in this case in the main query in need to wrap it like this? : $"actor.displayName"|s$

Sorry for asking probably very basic question...

Re: Splunk dashboard drop-down menu has spaces in the values, causing the dashboard to not be able to retrieve data.

Maximussss — Thu, 02 Nov 2023 15:45:02 GMT

Re: Splunk dashboard drop-down menu has spaces in the values, causing the dashboard to not be able to retrieve data.

ITWhisperer — Thu, 02 Nov 2023 15:26:19 GMT

$actor.displayName|s$

Having said that, you should probably avoid using dot in names where possible, so perhaps name your token as actorDisplayName and use $actorDisplayName|s$

Re: Splunk dashboard drop-down menu has spaces in the values, causing the dashboard to not be able to retrieve data.

Maximussss — Thu, 02 Nov 2023 15:48:04 GMT

This name already comes from OKTA logs with dot, unfortunately I wont be able to change it. Need to work with what I have. Thank you for help! A appreciate it!

Re: Splunk dashboard drop-down menu has spaces in the values, causing the dashboard to not be able to retrieve data.

ITWhisperer — Thu, 02 Nov 2023 16:14:14 GMT

The name of the field might come from the log but the name of the token doesn't have to match, if you can edit the dashboard, you can change the name of the token.

Re: Splunk dashboard drop-down menu has spaces in the values, causing the dashboard to not be able to retrieve data.

Maximussss — Thu, 02 Nov 2023 19:12:13 GMT

@ITWhisperer Want to say THANK YOU again! Just tried to wrap it and everything worked.

It took me a while to understand that I need to wrap it not in the main query but in my additional part when I'm trying to pass the token to other components.

Re: Splunk dashboard drop-down menu has spaces in the values, causing the dashboard to not be able to retrieve data.

sekarjegan93 — Wed, 12 Mar 2025 13:49:13 GMT

@ITWhisperer How do use this token in dashboard studio drilldown URL? any modifiers available to dynamically add UTF encoding for space and special characters?

Re: Splunk dashboard drop-down menu has spaces in the values, causing the dashboard to not be able to retrieve data.

ITWhisperer — Wed, 12 Mar 2025 13:53:45 GMT

Token modifiers can be found here https://docs.splunk.com/Documentation/SplunkCloud/latest/Viz/tokens#Syntax_to_consume_tokens

I don't use Studio very much as it doesn't have all the features available to Classic Simple XML dashboards, so I can't guarantee that this will work for Studio.

Re: Splunk dashboard drop-down menu has spaces in the values, causing the dashboard to not be able to retrieve data.

sekarjegan93 — Wed, 12 Mar 2025 15:25:56 GMT

Thanks much. I got it worked using below modifier

URL format: $token_name|u$