topic Re: How are strings from an UI-"input" interpreted in another string search? in Splunk Search

How are strings from an UI-"input" interpreted in another string search?

GaryZ — Mon, 17 Apr 2023 20:08:31 GMT

I have the following search string in my chart panel.

"Arguments.category{}"= "$TestSuite$"

TestSuite is defined by the following dropdown UI-Input.

| stats count by test_suite
| fields test_suite

My question is when I use this string

"Arguments.category{}"= "$TestSuite$"

The output returns this search

"Arguments.category{}"= "(backend/resource_ql)"

I am interested in getting this (without the parenthesis).

"Arguments.category{}"= "backend/resource_ql"

What am I doing wrong? Thanks in advance.

Re: How are strings from an UI-"input" interpreted in another string search?

yeahnah — Mon, 17 Apr 2023 23:13:50 GMT

Hi @GaryZ

It would be easier to check if you provide the dashboard source XML, in case there is something strange going on there. Please post the source XML inside a code sample block.

Re: How are strings from an UI-"input" interpreted in another string search?

GaryZ — Tue, 18 Apr 2023 16:34:29 GMT

hello @yeahnah

This is the code (redacted) that generated the input. Please let me know if you any more information. Thanks.

<input type="dropdown" token="TestSuite" searchWhenChanged="true"> <label>TestSuite</label> <default>backend/abc</default> <initialValue>backend/abc</initialValue> <fieldForLabel>test_suite</fieldForLabel> <fieldForValue>test_suite</fieldForValue> <search> <query>index=service_index | rename "Arguments.category{}" as test_suite | stats count by test_suite | fields test_suite</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <prefix>"</prefix> <suffix>"</suffix> </input>

This is the code that's using the input from $TestSuite$

<row> <panel> <chart> <title>Test Status (24Hrs)</title> <search> <query>index=service_index | where "Arguments.category{}" IN $TestSuite$ | stats count by Status</query> <earliest>$timeRange.earliest$</earliest> <latest>$timeRange.latest$</latest> </search> <option name="charting.chart">pie</option> <option name="charting.drilldown">none</option> <option name="refresh.display">progressbar</option> </chart> </panel> </row>

Re: How are strings from an UI-"input" interpreted in another string search?

woodcock — Tue, 18 Apr 2023 17:51:56 GMT

You are using the wrong syntax in your "where". IMHO it should be:
| search Arguments.category() = "$TestSuite$"

| makeresults | eval "Arguments.category{}" = "xxx" | rename * AS *{} | search "Arguments.category{}" = "xxx" | search Arguments.category{} = "xxx" | where 'Arguments.category{}' = "xxx"

TestSuite

Re: How are strings from an UI-"input" interpreted in another string search?

GaryZ — Tue, 18 Apr 2023 18:01:15 GMT

@woodcock

Would this be the same if I'm using either a dropdown vs. multi-select input?

I used the following for the multi-select case

where 'Arguments.category{}' IN $TestSuite$

I was then using the following when I was using the dropdown.

where 'Arguments.category{}' = "xxx"

However my issue is what's interpreted when I'm using either input types.

When I use this search string

"Arguments.category{}"= "$TestSuite$"

The output returns this search (with the parenthesis)

"Arguments.category{}"= "(backend/abc)"

I am interested in getting this (without the parenthesis).

"Arguments.category{}"= "backend/abc"

I'm curious if there's something I'm missing (or doing wrong) when I'm setting up the input UIs.

Re: How are strings from an UI-"input" interpreted in another string search?

woodcock — Fri, 21 Apr 2023 15:28:22 GMT

(redacted) You posted "dropdown", not "multiselect". (redacted)

Re: How are strings from an UI-"input" interpreted in another string search?

GaryZ — Tue, 18 Apr 2023 18:22:19 GMT

@woodcock

Ideally I want multi-select. I do understand the syntax in the dropdown. however, the issue I'm having is the interpretation I'm getting in the search string when I'm using either of the case - dropdown or multi-select.

Sorry for these newby questions. I'm fairly new to Splunk, and have a lot to learn. Thank you for being patient.

Re: How are strings from an UI-"input" interpreted in another string search?

woodcock — Tue, 18 Apr 2023 18:52:33 GMT

This is the stuff you need:
<label>TestSuite</label>
<prefix>Arguments.category{} IN(</prefix>
<suffix>)</suffix>
<valuePrefix>"</valuePrefix>
<valueSuffix>"</valueSuffix>
<delimiter>,</delimiter>

Then just use "| search $TestSuite$"