Dashboards & Visualizations

Dropdown Input and accent characters

ookamidono
Explorer

I would like to create a dashboard with a dropdown input.
The input would affect dynamically the field application_methodName.
The problem is that I have some method names that contain accents in it, and they are not recognized when doing a search through this input.
Next is the code of the input query :

index=my_index timeseriesId="
appmethod.useractions"
| dedup application_methodId
| table application_methodName
| sort application_methodName


And the code of the query I'm trying to match with the dropdown input :

index=my_index application_methodName="$userAction_token$" timeseriesId="appmethod.useractions"
| stats sum(value)

I could also use a application_methodId field as the dropdown token (that would erase the problem), but then it won't be user friendly anymore. 
Any idea on how to make the query recognize accents ? Or a way to use the id as the token while still displaying the name in the dropdown ? 

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Your dropdown can use two columns from the query, one for the label (what the user sees) and one for the value (what the token is set to). Change your query for the dropdown to return two columns and use fieldforlabel and fieldforvalue options to define which is which.

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Your dropdown can use two columns from the query, one for the label (what the user sees) and one for the value (what the token is set to). Change your query for the dropdown to return two columns and use fieldforlabel and fieldforvalue options to define which is which.

ookamidono
Explorer

Thanks for the quick answer, it works perfectly well.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...