Dashboards & Visualizations

How do I put my search string in a dashboard panel with a colon in the field name?

Path Finder

Hi Guys

I have a search string which quotes field names with $ and works great. However, when I put that into a panel on a dashboard, I get the "waiting for input" message on the panel.

Search string:

index=aws-bill user:showback!=""  | eval showback=case(match($user:showback$, "IT Enterprise Services:*"), "INFRA", match($user:showback$, "IT:*"), "OtherIT", match($user:showback$, "Websites:*"), "WEBSITES", 1=1, "OLDDATA") | timechart sum(BlendedCost) as $ by showback useother=f limit=10

If I remove the $ quotes, eval complains about malformed expression due to the colon in the name.

So what am I doing wrong?

Mark

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Consider renaming the field to something without a colon in it.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

SplunkTrust
SplunkTrust

Consider renaming the field to something without a colon in it.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

Path Finder

Thanks Rich - that's working now. never come across "rename" before.

0 Karma

Path Finder

Thanks for the suggestion but how would I do that? I've tried:

index=aws-bill user:showback!=""  | rex field=_raw mode=sed "s/\://g" | eval showback=case(match(usershowback, "IT Enterprise Services:*"), "INFRA", match(usershowback, "IT:*"), "JUSTIT", match(usershowback, "Websites:*"), "WEBSITES", 1=1, "OLDDATA") | timechart sum(BlendedCost) as $ by showback useother=f limit=10

The colon is gone in the raw data but the eval is not picking it up.

0 Karma

SplunkTrust
SplunkTrust

Try this

index=aws-bill user:showback!=""  | rename "user:showback" as user_showback | eval showback=case(match($user_showback$, "IT Enterprise Services:*"), "INFRA", match($user_showback$, "IT:*"), "OtherIT", match($user_showback$, "Websites:*"), "WEBSITES", 1=1, "OLDDATA") | timechart sum(BlendedCost) as $ by showback useother=f limit=10
---
If this reply helps you, an upvote would be appreciated.