Dashboards & Visualizations

Issue in passing the selected value from doprdown to savedsearch

anjith05
New Member

i have a dropdown which is populated by search results, i want to pass the selected value to a savedsearch, the output of the search result is of format num1-num2 when i pass the value to savedsearch it is getting the difference between the numbers i need the selected value in original format not the difference between the two numbers, the hyphen is being detected as a minus operator.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Have you tried putting the value in quotation marks ("num1-num2")? You can do that by adding |s to your token as in $tokenName|s$.

---
If this reply helps you, Karma would be appreciated.
0 Karma

anjith05
New Member

thanks for the update, i tried below, but still shows the diff
| savedsearch "xxxxxx" Token=$Token|s$

in the savedsearch xxxxxx - i have below, just to see whats coming in...
index=abc sourcetype=xyz
| eval TicketIn=$Token$
| table TicketIn

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...