Dashboards & Visualizations

How to pass drop down token

MeMilo09
Path Finder

Hi Guys,

I got my query right and I see my values properly populate on the dropdown input. However, I cant pass this token to populate my query on to the next query. Is there something wrong with my xml? 

<input type="dropdown" token="sourceName" searchWhenChanged="true">

      <label>Select SourceName</label>

      <choice value="*">All</choice>

      <default>*</default>

      <fieldForLabel>sourcename</fieldForLabel>

      <fieldForValue>sourcename</fieldForValue>

      <search>

        <query>index="example_of_idx" sourcename=Service_Requested OR sourcename=Service_Suggested | stats count by sourcename  | replace  Service_Requested WITH "Type of Service"  Service_Suggested WITH "Type of Service Suggested" IN sourcename | table sourcename </query>

      </search>

    </input>
Labels (1)
Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Your query search seems to only return two values "Service_Requested" and "Service_Suggested" (assuming they exist in example_of_idx), which you then replace with phrases with embedded spaces. If you are using these values (with embedded spaces), are you protecting the spaces e.g. do you use the token filter |s to wrap the token value in quotes? Also, do you actually want the replacement string passed or is that really just for the dropdown? If it is for the dropdown, you should do something like this:

<input type="dropdown" token="sourceName" searchWhenChanged="true">
      <label>Select SourceName</label>
      <choice value="*">All</choice>
      <default>*</default>
      <fieldForLabel>label</fieldForLabel>
      <fieldForValue>sourcename</fieldForValue>
      <search>
        <query>index="example_of_idx" sourcename=Service_Requested OR sourcename=Service_Suggested | stats count by sourcename | eval label=sourcename | replace  Service_Requested WITH "Type of Service"  Service_Suggested WITH "Type of Service Suggested" IN label | table sourcename label</query>
      </search>
    </input>

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Your query search seems to only return two values "Service_Requested" and "Service_Suggested" (assuming they exist in example_of_idx), which you then replace with phrases with embedded spaces. If you are using these values (with embedded spaces), are you protecting the spaces e.g. do you use the token filter |s to wrap the token value in quotes? Also, do you actually want the replacement string passed or is that really just for the dropdown? If it is for the dropdown, you should do something like this:

<input type="dropdown" token="sourceName" searchWhenChanged="true">
      <label>Select SourceName</label>
      <choice value="*">All</choice>
      <default>*</default>
      <fieldForLabel>label</fieldForLabel>
      <fieldForValue>sourcename</fieldForValue>
      <search>
        <query>index="example_of_idx" sourcename=Service_Requested OR sourcename=Service_Suggested | stats count by sourcename | eval label=sourcename | replace  Service_Requested WITH "Type of Service"  Service_Suggested WITH "Type of Service Suggested" IN label | table sourcename label</query>
      </search>
    </input>

MeMilo09
Path Finder

Thanks!  @ITWhisperer  the eval command did fixed the problem. 

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust
Can you please share your sample XML? So we can check which token you are using at what place and other things.
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

A Four-Part Event Series: Full Stack Observability For the AI Era

As AI reshapes applications, infrastructure, and the way teams operate, the traditional boundaries of ...

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Event Series: Level up your SOC: Advancing with Splunk Enterprise Security

AI has fundamentally raised the stakes for security operations, and this three-part series is your guide to ...