Hi there,
i'm a new splunk user and try to use the new Dashboard Studio variant of dashboards like the last example described here: https://docs.splunk.com/Documentation/Splunk/8.2.4/DashStudio/inputs#Example:_Search-based_cascading...
My Problem is the values for the dynamic multiselect input have whitespaces in it and as soon as i use the "IN" operator in the search query this retruns no entries. If i manually change the search query and put all the values in quotes it is working as expected. Is there any way to do this in the definition of the input?
I can also append a
eval appDisplayName = \"\\\"\".appDisplayName.\"\\\"\"
to the ds.search query but this also adds the quotes to the display portion.
My complete json looks like this:
{
"visualizations": {
"viz_hSyaQ4tf": {
"type": "splunk.table",
"options": {},
"dataSources": {
"primary": "ds_saMdKSzT"
}
}
},
"dataSources": {
"ds_saMdKSzT": {
"type": "ds.search",
"options": {
"query": "sourcetype=\"azure:aad:signin\" userPrincipalName=$userPrincipalName$ AND appDisplayName IN ($appDisplayName$) | table createdDateTime userPrincipalName userId appDisplayName appId resourceDisplayName resourceId conditionalAccessStatus status.errorCode",
"queryParameters": {
"latest": "$global_time.latest$",
"earliest": "$global_time.earliest$"
}
},
"name": "SignIns"
},
"ds_XdUxasDT": {
"type": "ds.search",
"options": {
"query": "sourcetype=\"azure:aad:signin\" | stats count by userPrincipalName",
"queryParameters": {
"latest": "$global_time.latest$",
"earliest": "$global_time.earliest$"
}
},
"name": "userPrincipalName-stats"
},
"ds_GQslD2fp": {
"type": "ds.search",
"options": {
"query": "sourcetype=\"azure:aad:signin\" userPrincipalName=$userPrincipalName$ | stats count by appDisplayName",
"queryParameters": {
"latest": "$global_time.latest$",
"earliest": "$global_time.earliest$"
}
},
"name": "appDisplayName-stats"
}
},
"defaults": {
"dataSources": {
"ds.search": {
"options": {
"queryParameters": {
"latest": "$global_time.latest$",
"earliest": "$global_time.earliest$"
}
}
}
}
},
"inputs": {
"input_global_trp": {
"type": "input.timerange",
"options": {
"token": "global_time",
"defaultValue": "-24h@h,now"
},
"title": "Global Time Range"
},
"input_hcQWlw8q": {
"title": "Select App",
"type": "input.multiselect",
"options": {
"items": ">frame(label, value) | prepend(formattedStatics) | objects()",
"token": "appDisplayName"
},
"dataSources": {
"primary": "ds_GQslD2fp"
},
"context": {
"formattedConfig": {
"number": {
"prefix": ""
}
},
"formattedStatics": ">statics | formatByType(formattedConfig)",
"statics": [
[
"All"
],
[
"*"
]
],
"label": ">primary | seriesByName(\"appDisplayName\") | renameSeries(\"label\") | formatByType(formattedConfig)",
"value": ">primary | seriesByName(\"appDisplayName\") | renameSeries(\"value\") | formatByType(formattedConfig)"
}
},
"input_E26xAMU9": {
"options": {
"defaultValue": "user@domain.com",
"token": "userPrincipalName"
},
"title": "Select User",
"type": "input.text"
}
},
"layout": {
"type": "grid",
"options": {},
"structure": [
{
"item": "viz_hSyaQ4tf",
"type": "block",
"position": {
"x": 0,
"y": 0,
"w": 1200,
"h": 400
}
}
],
"globalInputs": [
"input_global_trp",
"input_E26xAMU9",
"input_hcQWlw8q"
]
},
"description": "",
"title": "Azure AD SignIns"
}
This produces the not working query like this:
sourcetype="azure:aad:signin" userPrincipalName=bauera@herrenknecht.com AND appDisplayName IN (Microsoft Office 365 Portal,Windows Sign In,Office365 Shell WCSS-Client) | table createdDateTime userPrincipalName userId appDisplayName appId resourceDisplayName resourceId conditionalAccessStatus status.errorCode
I want it to be like this:
sourcetype="azure:aad:signin" userPrincipalName=bauera@herrenknecht.com AND appDisplayName IN ("Microsoft Office 365 Portal","Windows Sign In","Office365 Shell WCSS-Client") | table createdDateTime userPrincipalName userId appDisplayName appId resourceDisplayName resourceId conditionalAccessStatus status.errorCode
Thanks for your help.
Greetings
Andreas
