Dashboards & Visualizations

Dropdown in a Form

bt149
Path Finder

I have a dashboard (form) where I have a dropdown to choose between two different types of "changes" that may have happened in one of our environments.  When one of the dropdowns is chosen, a table is populated with results.

The dropdown menu is configured:

<choice value="index=something blah blah blah | table 1 2 3">Config Change</choice>

<choice value="index=another_index blah blah blah | table 7 8 9">Admin Change</choice>

The table portion is configured:

<query>$tok_change$</query>

This all works great.  I have a need to eval a field called Name in the Config Change "choice".  This Name field will have a value of "A change to the system was made."

The comes in when I add the following to the SPL:
eval Name="A change to the system was made"

I receive the following message:

"Error on line 8: Invalid attribute name"

I figure it has something to do with the quote in the eval statement but I can't make this happen.  Any help / guidance is greatly appreciated.

 

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi  @bt149,

let me understand:

you use in a panel a search choosed on the drilldown, and then you want to add an eval command to the search, is it correct?

are you using this notation?

<query>
   $tok_change$
   | eval Name="A change to the system was made"
</query>

in other words, are you using the pipe before the eval command?

Ciao.

Giuseppe

0 Karma

bt149
Path Finder

I used &quot; around the eval and it worked.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...

Design, Compete, Win: Submit Your Best Splunk Dashboards for a .conf26 Pass

Hello Splunkers,  We’re excited to kick off a Splunk Dashboard contest! We know that dashboards are a primary ...

May 2026 Splunk Expert Sessions: Security & Observability

Level Up Your Operations: May 2026 Splunk Expert Sessions Whether you are refining your security posture or ...