Dashboards & Visualizations

Dropdown in a Form

bt149
Path Finder

I have a dashboard (form) where I have a dropdown to choose between two different types of "changes" that may have happened in one of our environments.  When one of the dropdowns is chosen, a table is populated with results.

The dropdown menu is configured:

<choice value="index=something blah blah blah | table 1 2 3">Config Change</choice>

<choice value="index=another_index blah blah blah | table 7 8 9">Admin Change</choice>

The table portion is configured:

<query>$tok_change$</query>

This all works great.  I have a need to eval a field called Name in the Config Change "choice".  This Name field will have a value of "A change to the system was made."

The comes in when I add the following to the SPL:
eval Name="A change to the system was made"

I receive the following message:

"Error on line 8: Invalid attribute name"

I figure it has something to do with the quote in the eval statement but I can't make this happen.  Any help / guidance is greatly appreciated.

 

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi  @bt149,

let me understand:

you use in a panel a search choosed on the drilldown, and then you want to add an eval command to the search, is it correct?

are you using this notation?

<query>
   $tok_change$
   | eval Name="A change to the system was made"
</query>

in other words, are you using the pipe before the eval command?

Ciao.

Giuseppe

0 Karma

bt149
Path Finder

I used &quot; around the eval and it worked.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

From Data to Insight: Announcing the Winners of the Splunk Dashboard Contest

Hi Splunkers, First off, thank you to everyone who participated in our very first From Data to Insight: The ...

Splunk Developers: Construct Your Future at the .conf26 Builder Bar

Calling all Splunk architects, platform admins, and app developers: the site is open, and the blueprints are ...

Quick connection discovery mode for forwarders

When a Splunk forwarder loses connectivity to its indexers, it does not always reconnect immediately. In many ...