How to create chart to not display single value data when * is set in a token?

[stobipole]

Hi,

I'm relatively new to Splunk so it's been a bit of a learning curve!

I'm building a dashboard using Splunk Cloud Dashboard Studio that shows both overview and site specific visualisations - key items being a map to show where all sites are, and once a site is selected some specific data.

Basics of Dashboard:

Site Name Dropdown (sets token $SiteName$):
All (*)

Site 1

Site 2

Map - configured with markers (lat/long)

Single Value - configured to display the site name that was selected from dropdown ($SiteName$ token)

Basic Search - <base search> | search "Site Name" = "$SiteName$"

Behaviour:

Map and Single Value visualisations work as desired when a specific site is selected.

<base search> | search "Site Name" = "Site 2"

Issue:

When All is selected (sets token $SiteName$ to *) the search becomes:

<base search> | search "Site Name" ="*"

Map - shows all sites (desired)

Single Value - shows 'Site 1' as it's the first returned value of the search (all sites are returned in the search results)

Any Suggestions?

[ITWhisperer]

What is it that you want the single item to display when * is selected?

What is your search for the single item?

[stobipole]

Hi,

Either nothing or 'Please select a site'

| inputlookup siteDetails.csv

| search "Site Name" ="$SiteName$"

Single value box uses the "Site Name" value

[ITWhisperer]

Try something like this

| inputlookup siteDetails.csv

| where 'Site Name' ="$SiteName$"

[stobipole]

Thank you, I think that has done it - should have asked earlier, been trying to understand this for a couple of days!

I'll mark as accepted solution once I've done some further validation