Dashboards & Visualizations

Dropdown in a Form

bt149
Path Finder

I have a dashboard (form) where I have a dropdown to choose between two different types of "changes" that may have happened in one of our environments.  When one of the dropdowns is chosen, a table is populated with results.

The dropdown menu is configured:

<choice value="index=something blah blah blah | table 1 2 3">Config Change</choice>

<choice value="index=another_index blah blah blah | table 7 8 9">Admin Change</choice>

The table portion is configured:

<query>$tok_change$</query>

This all works great.  I have a need to eval a field called Name in the Config Change "choice".  This Name field will have a value of "A change to the system was made."

The comes in when I add the following to the SPL:
eval Name="A change to the system was made"

I receive the following message:

"Error on line 8: Invalid attribute name"

I figure it has something to do with the quote in the eval statement but I can't make this happen.  Any help / guidance is greatly appreciated.

 

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi  @bt149,

let me understand:

you use in a panel a search choosed on the drilldown, and then you want to add an eval command to the search, is it correct?

are you using this notation?

<query>
   $tok_change$
   | eval Name="A change to the system was made"
</query>

in other words, are you using the pipe before the eval command?

Ciao.

Giuseppe

0 Karma

bt149
Path Finder

I used &quot; around the eval and it worked.

0 Karma
Get Updates on the Splunk Community!

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...