Dashboards & Visualizations

Dashboard Studio Multiselect with dynamic items and wrong search pattern / missing quotes?

bauera-hk
Observer

Hi there,

i'm a new splunk user and try to use the new Dashboard Studio variant of dashboards like the last example described here: https://docs.splunk.com/Documentation/Splunk/8.2.4/DashStudio/inputs#Example:_Search-based_cascading...

My Problem is the values for the dynamic multiselect input have whitespaces in it and as soon as i use the "IN" operator in the search query this retruns no entries. If i manually change the search query and put all the values in quotes it is working as expected. Is there any way to do this in the definition of the input?

I can also append a 

 

 

 

eval appDisplayName = \"\\\"\".appDisplayName.\"\\\"\"

 

 

 

to the ds.search query but this also adds the quotes to the display portion.

 

My complete json looks like this:

 

 

 

{
	"visualizations": {
		"viz_hSyaQ4tf": {
			"type": "splunk.table",
			"options": {},
			"dataSources": {
				"primary": "ds_saMdKSzT"
			}
		}
	},
	"dataSources": {
		"ds_saMdKSzT": {
			"type": "ds.search",
			"options": {
				"query": "sourcetype=\"azure:aad:signin\" userPrincipalName=$userPrincipalName$ AND appDisplayName IN ($appDisplayName$) | table createdDateTime userPrincipalName userId appDisplayName appId resourceDisplayName resourceId conditionalAccessStatus status.errorCode",
				"queryParameters": {
					"latest": "$global_time.latest$",
					"earliest": "$global_time.earliest$"
				}
			},
			"name": "SignIns"
		},
		"ds_XdUxasDT": {
			"type": "ds.search",
			"options": {
				"query": "sourcetype=\"azure:aad:signin\" | stats count by userPrincipalName",
				"queryParameters": {
					"latest": "$global_time.latest$",
					"earliest": "$global_time.earliest$"
				}
			},
			"name": "userPrincipalName-stats"
		},
		"ds_GQslD2fp": {
			"type": "ds.search",
			"options": {
				"query": "sourcetype=\"azure:aad:signin\" userPrincipalName=$userPrincipalName$ | stats count by appDisplayName",
				"queryParameters": {
					"latest": "$global_time.latest$",
					"earliest": "$global_time.earliest$"
				}
			},
			"name": "appDisplayName-stats"
		}
	},
	"defaults": {
		"dataSources": {
			"ds.search": {
				"options": {
					"queryParameters": {
						"latest": "$global_time.latest$",
						"earliest": "$global_time.earliest$"
					}
				}
			}
		}
	},
	"inputs": {
		"input_global_trp": {
			"type": "input.timerange",
			"options": {
				"token": "global_time",
				"defaultValue": "-24h@h,now"
			},
			"title": "Global Time Range"
		},
		"input_hcQWlw8q": {
			"title": "Select App",
			"type": "input.multiselect",
			"options": {
				"items": ">frame(label, value) | prepend(formattedStatics) | objects()",
				"token": "appDisplayName"
			},
			"dataSources": {
				"primary": "ds_GQslD2fp"
			},
			"context": {
				"formattedConfig": {
					"number": {
						"prefix": ""
					}
				},
				"formattedStatics": ">statics | formatByType(formattedConfig)",
				"statics": [
					[
						"All"
					],
					[
						"*"
					]
				],
				"label": ">primary | seriesByName(\"appDisplayName\") | renameSeries(\"label\") | formatByType(formattedConfig)",
				"value": ">primary | seriesByName(\"appDisplayName\") | renameSeries(\"value\") | formatByType(formattedConfig)"
			}
		},
		"input_E26xAMU9": {
			"options": {
				"defaultValue": "user@domain.com",
				"token": "userPrincipalName"
			},
			"title": "Select User",
			"type": "input.text"
		}
	},
	"layout": {
		"type": "grid",
		"options": {},
		"structure": [
			{
				"item": "viz_hSyaQ4tf",
				"type": "block",
				"position": {
					"x": 0,
					"y": 0,
					"w": 1200,
					"h": 400
				}
			}
		],
		"globalInputs": [
			"input_global_trp",
			"input_E26xAMU9",
			"input_hcQWlw8q"
		]
	},
	"description": "",
	"title": "Azure AD SignIns"
}

 

 

 

 
This produces the not working query like this:

 

 

 

sourcetype="azure:aad:signin" userPrincipalName=bauera@herrenknecht.com AND appDisplayName IN (Microsoft Office 365 Portal,Windows Sign In,Office365 Shell WCSS-Client) | table createdDateTime userPrincipalName userId appDisplayName appId resourceDisplayName resourceId conditionalAccessStatus status.errorCode

 

 

 

 I want it to be like this:

 

 

 

sourcetype="azure:aad:signin" userPrincipalName=bauera@herrenknecht.com AND appDisplayName IN ("Microsoft Office 365 Portal","Windows Sign In","Office365 Shell WCSS-Client") | table createdDateTime userPrincipalName userId appDisplayName appId resourceDisplayName resourceId conditionalAccessStatus status.errorCode

 

 

 

 

Thanks for your help.

 

Greetings

Andreas

Labels (1)
0 Karma

oovidiu
Engager

For whoever else that needs this: your search field IN ... will accept this multivalue token passed to it:


$your_multivalue_select_tokenhere_that_also_accepts_*_as_default|s$

0 Karma

mleati
Explorer

I have been unable to find an elegant solution for this issue (it looks like Dashboard Studio is not quite "there" yet) but the following technique does work.

1.  Modify data source query by adding a new field:

| eval q_appDisplayName = "\"" . appDisplayName . "\""

2. Modify input definition as follows:

"input_hcQWlw8q": {
     "title": "Select App",
    "type""input.multiselect",
    "options": {
        "token": "appDisplayName"
        "defaultValue""*",
        "clearDefaultOnSelection"true,
        "items": [
            {
                "value""*",
                "label""All"
            }
        ]
    },
    "dataSources": {
        "primary""ds_GQslD2fp"
    },
    "encoding": {
        "value""primary.q_appDisplayName",
        "label""primary.appDisplayName"
    }
}
0 Karma

Lucas_Stern
Engager

Hi,

I had the same problem than you, and fixed it doing a escape of the values in the multiselect.

If you open the multiselect configs, there`s these two fields:

Lucas_Stern_0-1643232151137.png


The first one is the value that will be show to the user, and the second one will be the value selected used on the token. With that in mind, I escaped the field that I want to use ("Sistema" ) to another field (Sistema_escape) and select each like the image above.

 

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...