topic Re: Spl query is not working in Splunk Search

Spl query is not working

jaibalaraman — Thu, 22 Aug 2024 00:02:19 GMT

Hi Team

Could you please advice why the below query is not showing any data

" `secrpt-active-users($select321$)`"

Thanks

Re: Spl query is not working

jaibalaraman — Wed, 21 Aug 2024 22:51:45 GMT

Re: Spl query is not working

bowesmana — Thu, 22 Aug 2024 01:01:17 GMT

If this is in a dashboard, then that $select321$ looks to be a token and if that token has not been set you will get the message you are seeing.

On a separate point, are the double quotes surrounding the SPL or is that your post? Because it looks like it is a macro, but if the double quotes are really surrounding the macro, then it's not a macro, but a string.

Anyway, the token is your problem.

Re: Spl query is not working

jaibalaraman — Thu, 22 Aug 2024 01:08:51 GMT

Sorry the "" its my post

Re: Spl query is not working

jaibalaraman — Thu, 22 Aug 2024 01:10:01 GMT

When i am trying to expand the macro, i am getting the below error message

Re: Spl query is not working

jaibalaraman — Thu, 22 Aug 2024 01:12:00 GMT

When i navigate to check the token, i find the below

However i am not sure , is token existing or do i need to create new one.
1 - If i want to create a new token how should i map the spl query to this token ??

Re: Spl query is not working

bowesmana — Thu, 22 Aug 2024 01:24:13 GMT

Those are different tokens.

Things in your SPL that have $xxx$ are dashboard tokens and are set by logic in the dashboard, either through an input or through some drilldown.

Re: Spl query is not working

bowesmana — Thu, 22 Aug 2024 01:26:19 GMT

Is your problem from a search in a dashboard or a raw search in the search bar?

I suspect this is two issues - the first dashboard issue is a token issue and this is missing the ldapfilter command.

Is this your dashboard - if you do not have access to the ldapfilter command then even if you fix the token you make not get your search working.

Re: Spl query is not working

jaibalaraman — Thu, 22 Aug 2024 03:26:44 GMT

Problem from dashboard, this dashboard comes with default package of ITSI which i am trying to do reverse engineering fixing the dashboard

How do i fix this issue

What is ldapfilter command ? and how do i fix the token issue