Dashboards & Visualizations

Dashboard tokens interference with Map tokens

WwihgylWPiNbnXB
Engager

Hi everyone,

I have a inline search panel on a dashboard, that uses a parameter from a drop down input. Let's refer to it as token $A$ for simplicity.
The search panel runs a query involving the map command, using it's own token, which I will refer to as $B$.

index=kewl $A$ | head 1 | fields B |mvexpand B | map [ | dbquery db "select * from mytable where field=$B$" ] 

The dashboard panel does not run, awaiting for the B input forever.
Is there a way to isolate the context for the B token? or a nifty way to force the search to run without it?

Thanks for your help

Tags (3)
0 Karma
1 Solution

woodcock
Esteemed Legend

I believe you need to escape it with more $ like this:

index=kewl $A$ | head 1 | fields B |mvexpand B | map [ | dbquery db "select * from mytable where field=$$B$$" ]

View solution in original post

woodcock
Esteemed Legend

I believe you need to escape it with more $ like this:

index=kewl $A$ | head 1 | fields B |mvexpand B | map [ | dbquery db "select * from mytable where field=$$B$$" ]
Get Updates on the Splunk Community!

Splunk Edge Processor | Popular Use Cases to Get Started with Edge Processor

Splunk Edge Processor offers more efficient, flexible data transformation – helping you reduce noise, control ...

Introducing New Splunkbase Governance!

Splunk apps are essential for maximizing the value of your Splunk Experience. Whether you’re using the default ...

3 Ways to Make OpenTelemetry Even Better

My role as an Observability Specialist at Splunk provides me with the opportunity to work with customers of ...