Dashboards & Visualizations

Use token in IN-Clause

danielsuter
Engager

I'm using a where field in ("term1", "term2") clause in a search. The terms should come from a token but I'm having troubles to do that. The search never fires or I get syntax problems.

I have a single select drop down from which the values for the in clause are coming:

<input type="dropdown" token="service">
  <label>Some label</label>
  <choice value="here come multiple terms">All</choice>
  <choice value="here comes one term">One term desc</choice>
</input>

Now I want to use it in my search clause

        | where service_field in($service$)
Tags (2)

somesoni2
Revered Legend

The value list in infunction is a comma separated quoted strings. Make sure your dropdown is formatting it that way.

0 Karma

renjith_nair
Legend

@danielsuter,

Is the dropdown populated by dynamic search or static values ? How do you represent value for "All" ?

If they are static, would this work ?

    <input type="dropdown" token="service">
      <label>Terms</label>
      <choice value="&quot;A&quot;, &quot;B&quot;,&quot;C&quot;">All</choice>
      <choice value="&quot;here comes one term&quot;">One term desc</choice>
    </input>
---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma
Get Updates on the Splunk Community!

Your Guide to Splunk Digital Experience Monitoring

A flawless digital experience isn't just an advantage, it's key to customer loyalty and business success. But ...

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...