Dashboards & Visualizations

Dashboard Studio Multiselect with dynamic items and wrong search pattern / missing quotes

bauera-hk
Observer

Hi there,

i'm a new splunk user and try to use the new Dashboard Studio variant of dashboards like the last example described here: https://docs.splunk.com/Documentation/Splunk/8.2.4/DashStudio/inputs#Example:_Search-based_cascading...

My Problem is the values for the dynamic multiselect input have whitespaces in it and as soon as i use the "IN" operator in the search query this retruns no entries. If i manually change the search query and put all the values in quotes it is working as expected. Is there any way to do this in the definition of the input?

I can also append a 

 

 

eval appDisplayName = \"\\\"\".appDisplayName.\"\\\"\"

 

 

to the ds.search query but this also adds the quotes to the display portion.

 

My complete json looks like this:

 

 

{
	"visualizations": {
		"viz_hSyaQ4tf": {
			"type": "splunk.table",
			"options": {},
			"dataSources": {
				"primary": "ds_saMdKSzT"
			}
		}
	},
	"dataSources": {
		"ds_saMdKSzT": {
			"type": "ds.search",
			"options": {
				"query": "sourcetype=\"azure:aad:signin\" userPrincipalName=$userPrincipalName$ AND appDisplayName IN ($appDisplayName$) | table createdDateTime userPrincipalName userId appDisplayName appId resourceDisplayName resourceId conditionalAccessStatus status.errorCode",
				"queryParameters": {
					"latest": "$global_time.latest$",
					"earliest": "$global_time.earliest$"
				}
			},
			"name": "SignIns"
		},
		"ds_XdUxasDT": {
			"type": "ds.search",
			"options": {
				"query": "sourcetype=\"azure:aad:signin\" | stats count by userPrincipalName",
				"queryParameters": {
					"latest": "$global_time.latest$",
					"earliest": "$global_time.earliest$"
				}
			},
			"name": "userPrincipalName-stats"
		},
		"ds_GQslD2fp": {
			"type": "ds.search",
			"options": {
				"query": "sourcetype=\"azure:aad:signin\" userPrincipalName=$userPrincipalName$ | stats count by appDisplayName",
				"queryParameters": {
					"latest": "$global_time.latest$",
					"earliest": "$global_time.earliest$"
				}
			},
			"name": "appDisplayName-stats"
		}
	},
	"defaults": {
		"dataSources": {
			"ds.search": {
				"options": {
					"queryParameters": {
						"latest": "$global_time.latest$",
						"earliest": "$global_time.earliest$"
					}
				}
			}
		}
	},
	"inputs": {
		"input_global_trp": {
			"type": "input.timerange",
			"options": {
				"token": "global_time",
				"defaultValue": "-24h@h,now"
			},
			"title": "Global Time Range"
		},
		"input_hcQWlw8q": {
			"title": "Select App",
			"type": "input.multiselect",
			"options": {
				"items": ">frame(label, value) | prepend(formattedStatics) | objects()",
				"token": "appDisplayName"
			},
			"dataSources": {
				"primary": "ds_GQslD2fp"
			},
			"context": {
				"formattedConfig": {
					"number": {
						"prefix": ""
					}
				},
				"formattedStatics": ">statics | formatByType(formattedConfig)",
				"statics": [
					[
						"All"
					],
					[
						"*"
					]
				],
				"label": ">primary | seriesByName(\"appDisplayName\") | renameSeries(\"label\") | formatByType(formattedConfig)",
				"value": ">primary | seriesByName(\"appDisplayName\") | renameSeries(\"value\") | formatByType(formattedConfig)"
			}
		},
		"input_E26xAMU9": {
			"options": {
				"defaultValue": "user@domain.com",
				"token": "userPrincipalName"
			},
			"title": "Select User",
			"type": "input.text"
		}
	},
	"layout": {
		"type": "grid",
		"options": {},
		"structure": [
			{
				"item": "viz_hSyaQ4tf",
				"type": "block",
				"position": {
					"x": 0,
					"y": 0,
					"w": 1200,
					"h": 400
				}
			}
		],
		"globalInputs": [
			"input_global_trp",
			"input_E26xAMU9",
			"input_hcQWlw8q"
		]
	},
	"description": "",
	"title": "Azure AD SignIns"
}

 

 

 
This produces the not working query like this:

 

 

sourcetype="azure:aad:signin" userPrincipalName=bauera@herrenknecht.com AND appDisplayName IN (Microsoft Office 365 Portal,Windows Sign In,Office365 Shell WCSS-Client) | table createdDateTime userPrincipalName userId appDisplayName appId resourceDisplayName resourceId conditionalAccessStatus status.errorCode

 

 

 I want it to be like this:

 

 

sourcetype="azure:aad:signin" userPrincipalName=bauera@herrenknecht.com AND appDisplayName IN ("Microsoft Office 365 Portal","Windows Sign In","Office365 Shell WCSS-Client") | table createdDateTime userPrincipalName userId appDisplayName appId resourceDisplayName resourceId conditionalAccessStatus status.errorCode

 

 

 

Thanks for your help.

 

Greetings

Andreas

Labels (1)
0 Karma

Lucas_Stern
Engager

Hi,

I had the same problem than you, and fixed it doing a escape of the values in the multiselect.

If you open the multiselect configs, there`s these two fields:

Lucas_Stern_0-1643232151137.png


The first one is the value that will be show to the user, and the second one will be the value selected used on the token. With that in mind, I escaped the field that I want to use ("Sistema" ) to another field (Sistema_escape) and select each like the image above.

 

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>