Dashboards & Visualizations

Dropdown in a Form

bt149
Path Finder

I have a dashboard (form) where I have a dropdown to choose between two different types of "changes" that may have happened in one of our environments.  When one of the dropdowns is chosen, a table is populated with results.

The dropdown menu is configured:

<choice value="index=something blah blah blah | table 1 2 3">Config Change</choice>

<choice value="index=another_index blah blah blah | table 7 8 9">Admin Change</choice>

The table portion is configured:

<query>$tok_change$</query>

This all works great.  I have a need to eval a field called Name in the Config Change "choice".  This Name field will have a value of "A change to the system was made."

The comes in when I add the following to the SPL:
eval Name="A change to the system was made"

I receive the following message:

"Error on line 8: Invalid attribute name"

I figure it has something to do with the quote in the eval statement but I can't make this happen.  Any help / guidance is greatly appreciated.

 

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi  @bt149,

let me understand:

you use in a panel a search choosed on the drilldown, and then you want to add an eval command to the search, is it correct?

are you using this notation?

<query>
   $tok_change$
   | eval Name="A change to the system was made"
</query>

in other words, are you using the pipe before the eval command?

Ciao.

Giuseppe

0 Karma

bt149
Path Finder

I used &quot; around the eval and it worked.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Think Like an Architect: Introducing the Splunk Certified Cybersecurity Defense ...

In cybersecurity, defenders respond to threats. Architects design the systems that stop them.    As ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...