Dashboards & Visualizations

White spaces in field values when creating dynamic dropdown

shakSplunk
Path Finder

Hi all,

I've setup a dynamic dropdown field in a dashboard through the following configurations:

shakSplunk_0-1623289373152.png

I then use the field value as a input to filter one of the pivot tables on the dashboard (FILTER Artefact is $artefact$ ). However the issue I'm facing is that the Artefact values can sometimes have a whitespace in their values e.g. "foo bar" and this is creating an issue when filtering as it just filters by foo instead of foo bar. 

Any help would be highly appreciated!

Labels (2)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

tokens can be written like

$artefact|s$

where the |s before the trailing $ will ensure the token value is quoted appropriately. 

You can always do "$artefact$" but it's better practice to use |s so that it will be safe if ever processed by Javascript.

See https://docs.splunk.com/Documentation/Splunk/8.2.0/Viz/tokens#Syntax_to_consume_tokens

 

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

tokens can be written like

$artefact|s$

where the |s before the trailing $ will ensure the token value is quoted appropriately. 

You can always do "$artefact$" but it's better practice to use |s so that it will be safe if ever processed by Javascript.

See https://docs.splunk.com/Documentation/Splunk/8.2.0/Viz/tokens#Syntax_to_consume_tokens

 

Get Updates on the Splunk Community!

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...

[Live Demo] Watch SOC transformation in action with the reimagined Splunk Enterprise ...

Overwhelmed SOC? Splunk ES Has Your Back Tool sprawl, alert fatigue, and endless context switching are making ...

What’s New & Next in Splunk SOAR

Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us on ...