Token not binding with the dropdown on Splunk Dashboard

[man03359]

Hi All,

I'm trying to build a dashboard that will take input from a dropdown field and perform a search based on the item selected from the dashboard. I have two inputs, one dropdown and one multiselect.  I am passing two tokens, one $competency$ for dropdown and $sub_competency$ for multiselect. 

My token sub_competency is not syncing with the dashboard. I am adding like this
| search Sub_Competency="$sub_competency$"

| inputlookup cyber_q1_available_hours.csv 
| rename "Sub- Competency" as Sub_Competency
| search Sub_Competency="$sub_competency$" 
| eval split_name=split('Resource Name', ",")
| eval first_name=mvindex(split_name,1)
| eval last_name=mvindex(split_name,0)
| eval Resource_Name=trim(first_name) . " " . trim(last_name)
| stats count,values(Sub_Competency) as Sub_Competency values(Competency) as Competency values("FWD Looking Util")  as FWD_Util values("YTD Util") as YTD_Util by Resource_Name
| search Competency="$selected_competency$"
| table Resource_Name, Competency, Sub_Competency,FWD_Util,YTD_Util
|sort FWD_Util

Need some urgent help on this. 

Thanks in advance 🙂

[richgalloway]

I think you'll find the contents of the multi-select token are a multi-value field.  That means any place you use $sub_competency$ must make sense with a multi-value field.  Perhaps

| search Sub_Competency IN ("$sub_competency$")

would work better.

As @marnall suggested, it depends on what the token contents look like.

[man03359]

@richgalloway It is still not working , here is the xml code of my input-

<input type="multiselect" token="field2">
      <label>field2</label>
      <choice value="*">All</choice>
      <valuePrefix>"</valuePrefix>
      <valueSuffix>"</valueSuffix>
      <delimiter> OR </delimiter>
      <fieldForLabel>Sub_Competency</fieldForLabel>
      <fieldForValue>Sub_Competency</fieldForValue>
      <search>
        <query>| inputlookup cyber_q1_available_hours.csv 
| rename "Sub- Competency" as Sub_Competency
| dedup Sub_Competency
| table Sub_Competency</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
    </input>

XML code of main search

          <query>| inputlookup cyber_q1_available_hours.csv 
| rename "Sub- Competency" as Sub_Competency
| search Sub_Competency IN ("$sub_competency$")
| eval split_name=split('Resource Name', ",")
| eval first_name=mvindex(split_name,1)
| eval last_name=mvindex(split_name,0)
| eval Resource_Name=trim(first_name) . " " . trim(last_name)
| stats count,values(Sub_Competency) as Sub_Competency values(Competency) as Competency values("FWD Looking Util")  as FWD_Util values("YTD Util") as YTD_Util by Resource_Name
| search Competency="$selected_competency$"
| table Resource_Name, Competency, Sub_Competency,FWD_Util,YTD_Util
|sort FWD_Util</query>

[marnall]

Can you put the tokens into the dashboard titles, including the dollar signs? They will be replaced with the current value of the input, which is helpful for debugging that they are not a wrong value.

Alternatively you could post the source code of your inputs and search panel from your dashboard, so that we can see if there is a problem with them. (Be sure to censor any sensitive keywords in your source code)