Dashboards & Visualizations

Dashboard tokens interference with Map tokens

WwihgylWPiNbnXB
Engager

Hi everyone,

I have a inline search panel on a dashboard, that uses a parameter from a drop down input. Let's refer to it as token $A$ for simplicity.
The search panel runs a query involving the map command, using it's own token, which I will refer to as $B$.

index=kewl $A$ | head 1 | fields B |mvexpand B | map [ | dbquery db "select * from mytable where field=$B$" ] 

The dashboard panel does not run, awaiting for the B input forever.
Is there a way to isolate the context for the B token? or a nifty way to force the search to run without it?

Thanks for your help

Tags (3)
0 Karma
1 Solution

woodcock
Esteemed Legend

I believe you need to escape it with more $ like this:

index=kewl $A$ | head 1 | fields B |mvexpand B | map [ | dbquery db "select * from mytable where field=$$B$$" ]

View solution in original post

woodcock
Esteemed Legend

I believe you need to escape it with more $ like this:

index=kewl $A$ | head 1 | fields B |mvexpand B | map [ | dbquery db "select * from mytable where field=$$B$$" ]
Get Updates on the Splunk Community!

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Shape the Future of Splunk: Join the Product Research Lab!

Join the Splunk Product Research Lab and connect with us in the Slack channel #product-research-lab to get ...