How can I define my drop-down input properly so that values are entered into my search without the extraneous spaces?

[richardAtOmni]

Hi I'm trying to create a simple search input as a drop-down. I've defined static values for the drop-down. The problem I'm having is that each character in my value is being separated by a space when inserted into the search. Here's my entire search dashboard definition:

<form>
  <label>Riva Cloud Diagnostics By Time</label>
  <fieldset submitButton="false">
    <input type="time" token="time_tok">
      <label></label>
      <default>
        <earliest>-1m</earliest>
        <latest>now</latest>
      </default>
    </input>
    <input type="dropdown" token="pod_tok" searchWhenChanged="true">
      <label>pod</label>
      <default>*</default>
      <choice value="*">Any</choice>
      <choice value="na5">na5</choice>
      <choice value="xi5">xi5</choice>
      <choice value="yi5">yi5</choice>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>index="rc-diagnostics" pod="$pod_tok$" sourcetype=RivaDiagnostics* | table "_time", "pod", "message",  "referenceId", "exception", "errorDetails", "thread","processId", "levelInt", "userName"  | sort -_time | head 500</query>
          <earliest>$time_tok.earliest$</earliest>
          <latest>$time_tok.latest$</latest>
        </search>
        <option name="count">30</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</form>

When one of my "pod_tok" values are selected, in the search the values are being added with extra spaces.

For example, if I select 'na5' the resulting search looks like this:

index="rc-diagnostics" pod="n a 5" sourcetype=RivaDiagnostics* | table "_time", "pod", "message",  "referenceId", "exception", "errorDetails", "thread","processId", "levelInt", "userName"  | sort -_time | head 500

Which of course is incorrect.

How can I define my drop-down input properly so that the values are entered into my search without the extraneous spaces?

[cisconate]

This is INDEED the exact issue.  Editing via source and then simply closing/saving fixes the issue of the token adding spaces between each character which is then fed into any subsequent searches utilizing the token, which of course makes it fail.  Big thanks to "richardAtOmni"

[gokadroid]

Not sure why the extra space is coming through in token but can you please try to do these to see if it improves anything:

1. Replace pod="$pod_tok$" in your query to pod=$pod_tok|s$ if you want to wrap the token values with quotes around it. It might not help much but shall be the preferred way of "quoting" the token.
2. Remove the quotes around the field names in this part table "_time", "pod", "message", "referenceId", "exception", "errorDetails", "thread","processId", "levelInt", "userName" as fieldNames shall be recognized without the quotes too.

Try with pod=$pod_tok|n$ once which means no encoding. This is just a trial to see how does it change anything, if at all.

[richardAtOmni]

Thanks for your suggestions. If you haven't seen my other reply yet, the issue went away as soon as I left the splunk "source edit" mode. I have no idea why it happened, but it is resolved for me now. Thank you for your attention anyway!

[rjthibod]

That is really odd.

What version of Splunk Enterprise are you running?

Also, is the XML you posted straight from the XML web editor in Splunk? If not, can you post the XML straight from the editor in the browser so we can confirm it is not munging anything?

[ntennant]

I came here because this was my issue. It turns out that Splunk had set a " " option for me. I deleted this and it works, now.

[richardAtOmni]

Hi, the splunk version is:

Splunk Version
6.5.1
Splunk Build
f74036626f0c

And yes, the XML was straight from the web editor.

[richardAtOmni · Accepted solution]

In order to post this question, I opened my dashboard in "Edit Source" mode, so that I could paste the XML into this ticket. After posting, I exited "Edit Source" mode, and to my surprise, the inputs started working as expected, without the additional spaces!

Maybe this is a bug in Splunk? But if anyone else encounters this, try entering "Edit Source" mode, then exiting. That seemed to have done the trick for me.

Thanks!

[richardAtOmni]

In case this helps the Splunk team find the problem, I was able to reproduce the problem this way:

1. create the input as a "text" field, save.
2. Edit the dashboard, and change the input type to multi-select. In the multi-select, define the different static values. Save.
3. Edit the dashboard again, and change the input type to drop down. Save.
4. Now, when I select one of the values, it gets added to the search with the extra spaces. Wierd!

Hope this helps!