Dashboards & Visualizations

How can I define my drop-down input properly so that values are entered into my search without the extraneous spaces?

richardAtOmni
Path Finder

Hi I'm trying to create a simple search input as a drop-down. I've defined static values for the drop-down. The problem I'm having is that each character in my value is being separated by a space when inserted into the search. Here's my entire search dashboard definition:

<form>
  <label>Riva Cloud Diagnostics By Time</label>
  <fieldset submitButton="false">
    <input type="time" token="time_tok">
      <label></label>
      <default>
        <earliest>-1m</earliest>
        <latest>now</latest>
      </default>
    </input>
    <input type="dropdown" token="pod_tok" searchWhenChanged="true">
      <label>pod</label>
      <default>*</default>
      <choice value="*">Any</choice>
      <choice value="na5">na5</choice>
      <choice value="xi5">xi5</choice>
      <choice value="yi5">yi5</choice>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>index="rc-diagnostics" pod="$pod_tok$" sourcetype=RivaDiagnostics* | table "_time", "pod", "message",  "referenceId", "exception", "errorDetails", "thread","processId", "levelInt", "userName"  | sort -_time | head 500</query>
          <earliest>$time_tok.earliest$</earliest>
          <latest>$time_tok.latest$</latest>
        </search>
        <option name="count">30</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</form>

When one of my "pod_tok" values are selected, in the search the values are being added with extra spaces.

For example, if I select 'na5' the resulting search looks like this:

index="rc-diagnostics" pod="n a 5" sourcetype=RivaDiagnostics* | table "_time", "pod", "message",  "referenceId", "exception", "errorDetails", "thread","processId", "levelInt", "userName"  | sort -_time | head 500

Which of course is incorrect.

How can I define my drop-down input properly so that the values are entered into my search without the extraneous spaces?

0 Karma
1 Solution

richardAtOmni
Path Finder

In order to post this question, I opened my dashboard in "Edit Source" mode, so that I could paste the XML into this ticket. After posting, I exited "Edit Source" mode, and to my surprise, the inputs started working as expected, without the additional spaces!

Maybe this is a bug in Splunk? But if anyone else encounters this, try entering "Edit Source" mode, then exiting. That seemed to have done the trick for me.

Thanks!

View solution in original post

0 Karma

cisconate
Engager

This is INDEED the exact issue.  Editing via source and then simply closing/saving fixes the issue of the token adding spaces between each character which is then fed into any subsequent searches utilizing the token, which of course makes it fail.  Big thanks to "richardAtOmni"

0 Karma

gokadroid
Motivator

Not sure why the extra space is coming through in token but can you please try to do these to see if it improves anything:

  1. Replace pod="$pod_tok$" in your query to pod=$pod_tok|s$ if you want to wrap the token values with quotes around it. It might not help much but shall be the preferred way of "quoting" the token.
  2. Remove the quotes around the field names in this part table "_time", "pod", "message", "referenceId", "exception", "errorDetails", "thread","processId", "levelInt", "userName" as fieldNames shall be recognized without the quotes too.

Try with pod=$pod_tok|n$ once which means no encoding. This is just a trial to see how does it change anything, if at all.

0 Karma

richardAtOmni
Path Finder

Thanks for your suggestions. If you haven't seen my other reply yet, the issue went away as soon as I left the splunk "source edit" mode. I have no idea why it happened, but it is resolved for me now. Thank you for your attention anyway!

0 Karma

rjthibod
Champion

That is really odd.

What version of Splunk Enterprise are you running?

Also, is the XML you posted straight from the XML web editor in Splunk? If not, can you post the XML straight from the editor in the browser so we can confirm it is not munging anything?

0 Karma

ntennant
Loves-to-Learn

I came here because this was my issue. It turns out that Splunk had set a " " option for me. I deleted this and it works, now.

0 Karma

richardAtOmni
Path Finder

Hi, the splunk version is:

Splunk Version
6.5.1
Splunk Build
f74036626f0c

And yes, the XML was straight from the web editor.

0 Karma

richardAtOmni
Path Finder

In order to post this question, I opened my dashboard in "Edit Source" mode, so that I could paste the XML into this ticket. After posting, I exited "Edit Source" mode, and to my surprise, the inputs started working as expected, without the additional spaces!

Maybe this is a bug in Splunk? But if anyone else encounters this, try entering "Edit Source" mode, then exiting. That seemed to have done the trick for me.

Thanks!

0 Karma

richardAtOmni
Path Finder

In case this helps the Splunk team find the problem, I was able to reproduce the problem this way:

  1. create the input as a "text" field, save.
  2. Edit the dashboard, and change the input type to multi-select. In the multi-select, define the different static values. Save.
  3. Edit the dashboard again, and change the input type to drop down. Save.
  4. Now, when I select one of the values, it gets added to the search with the extra spaces. Wierd!

Hope this helps!

Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...