Hi all,
I am trying to pass a text box input in a dashboard called token ID1 which works fine but the issue here is that I am using the $ sign again to do a 2nd search from a field extract ID3 from index idx1 with a map search on index idx2 with the field that was extracted ID3.
The issue here I think is that the dashboard is expecting an input for ID3 because I am using the $ sign. As this search works fine when done in splunk search by manually passing ID1. How do I make the dashboard understand that it doesn't need an input for ID3?
index=idx1 $ID1$ | rex field=_raw "(?.*?)<.*?someString"(?.*?)">(?.*?)somemorestring" | dedup ID3 | map search="search (\"string1 with spaces\" OR string2 OR string3 OR \"string 4 with spaces\" OR \"string 5 with spaces\" OR \"string6\") index=idx2 $ID3$
"
Hope this makes sense,
Thanks for your help.
Tom
Have you tried wrapping ID3 with double dollar signs like this: $$ID3$$
? According to the docs, that is needed if you are referencing a variable within a map command on a form.
http://docs.splunk.com/Documentation/Splunk/7.1.0/Viz/tokens
Thanks a lot Elliot! worked like a charm 🙂
Glad to help! 🙂
Have you tried wrapping ID3 with double dollar signs like this: $$ID3$$
? According to the docs, that is needed if you are referencing a variable within a map command on a form.
http://docs.splunk.com/Documentation/Splunk/7.1.0/Viz/tokens