Hi I'm trying to create a simple search input as a drop-down. I've defined static values for the drop-down. The problem I'm having is that each character in my value is being separated by a space when inserted into the search. Here's my entire search dashboard definition:
<form> <label>Riva Cloud Diagnostics By Time</label> <fieldset submitButton="false"> <input type="time" token="time_tok"> <label></label> <default> <earliest>-1m</earliest> <latest>now</latest> </default> </input> <input type="dropdown" token="pod_tok" searchWhenChanged="true"> <label>pod</label> <default>*</default> <choice value="*">Any</choice> <choice value="na5">na5</choice> <choice value="xi5">xi5</choice> <choice value="yi5">yi5</choice> </input> </fieldset> <row> <panel> <table> <search> <query>index="rc-diagnostics" pod="$pod_tok$" sourcetype=RivaDiagnostics* | table "_time", "pod", "message", "referenceId", "exception", "errorDetails", "thread","processId", "levelInt", "userName" | sort -_time | head 500</query> <earliest>$time_tok.earliest$</earliest> <latest>$time_tok.latest$</latest> </search> <option name="count">30</option> <option name="wrap">true</option> </table> </panel> </row> </form>
When one of my "pod_tok" values are selected, in the search the values are being added with extra spaces.
For example, if I select 'na5' the resulting search looks like this:
index="rc-diagnostics" pod="n a 5" sourcetype=RivaDiagnostics* | table "_time", "pod", "message", "referenceId", "exception", "errorDetails", "thread","processId", "levelInt", "userName" | sort -_time | head 500
Which of course is incorrect.
How can I define my drop-down input properly so that the values are entered into my search without the extraneous spaces?
In order to post this question, I opened my dashboard in "Edit Source" mode, so that I could paste the XML into this ticket. After posting, I exited "Edit Source" mode, and to my surprise, the inputs started working as expected, without the additional spaces!
Maybe this is a bug in Splunk? But if anyone else encounters this, try entering "Edit Source" mode, then exiting. That seemed to have done the trick for me.
In case this helps the Splunk team find the problem, I was able to reproduce the problem this way:
Hope this helps!
That is really odd.
What version of Splunk Enterprise are you running?
Also, is the XML you posted straight from the XML web editor in Splunk? If not, can you post the XML straight from the editor in the browser so we can confirm it is not munging anything?
Hi, the splunk version is:
And yes, the XML was straight from the web editor.
I came here because this was my issue. It turns out that Splunk had set a " " option for me. I deleted this and it works, now.
Not sure why the extra space is coming through in token but can you please try to do these to see if it improves anything:
pod="$pod_tok$"in your query to
pod=$pod_tok|s$if you want to wrap the token values with quotes around it. It might not help much but shall be the preferred way of "quoting" the token.
table "_time", "pod", "message", "referenceId", "exception", "errorDetails", "thread","processId", "levelInt", "userName"as fieldNames shall be recognized without the quotes too.
pod=$pod_tok|n$ once which means no encoding. This is just a trial to see how does it change anything, if at all.
Thanks for your suggestions. If you haven't seen my other reply yet, the issue went away as soon as I left the splunk "source edit" mode. I have no idea why it happened, but it is resolved for me now. Thank you for your attention anyway!