Dashboards & Visualizations

Why aren't space characters saved on my dashboard?

jeffland
SplunkTrust
SplunkTrust

Hey,
I have a problem which has kind of been mentioned before, but wasn't sufficiently answered. For example, imagine I want to do multiple lookups in one search, using a multiselect to allow the user to choose which lookups to use. The code for the dashboard looks like this:

<input type="multiselect" token="lookup_tok" searchWhenChanged="true">
  <label>Geofences</label>
  <choice value="lookup_a">A</choice>
  <choice value="lookup_b">B</choice>
  <default>A</default>
  <valuePrefix>| lookup </valuePrefix>
  <valueSuffix> inputfield inputfield2 OUTPUTNEW field2</valueSuffix>
  <delimiter> </delimiter>
</input>
...
<search>
  <query>source=geo $lookup_tok$ | table ...</query>

The problem is with "valuePrefix" and "valueSuffix". There is a space character at the end of the prefix and the beginning of the suffix. These are obligatory, obviously - if they weren't present, the compiled token would look like

| lookuplookup_ainputfield...

Problem is, Splunk doesn't save that space character using the integrated UI-Editor, only when saving the Simple XML text directly containing a space. If I try to save those values from the UI in the dialog to edit an input, they simply aren't saved; what's worse is that if I add them in Simple XML (which results in the desired behavior) and then use the UI editor to change anything on the dashboard, they are removed (which breaks the dashboard). The problem is probably not the space character itself, I have tried using &#32; instead with the exact same results.
The same happens if you try to add the space characters in the actual "value"-attribute of the choices like so:

<input type="multiselect" token="geofence_lookup_tok" searchWhenChanged="true">
  <label>Geofences</label>
  <choice value=" geo_a ">A</choice>
  <choice value=" geo_b ">B</choice>
  <default>A</default>
  <valuePrefix>| lookup</valuePrefix>
  <valueSuffix>latitude longitude OUTPUTNEW featureId</valueSuffix>
  <delimiter> </delimiter>
</input>

This also comes into play when you don't want the token to have an effect under certain conditions - e.g. when you have an input to select whether to filter something or not:

<input type="dropdown" token="filter_tok" searchWhenChanged="true">
  <label>Filter</label>
  <choice value="| where foo>0">Filter foo</choice>
  <choice value=" ">Don't filter foo</choice>
...
<search>
  <query>source=baz | stats foo $filter_tok$</query>

This behavior can also be observed when you explicitly set a token:

<change>
  <condition label="Filter">
    <set token="some_token">| where something</set>
  </condition>
  <condition label="No Filter">
    <set token="some_token"> </set>
  </condition>

All these space characters will disappear when using the UI to edit the dashboard. Any Ideas?

spammenot66
Contributor

What I've found to work is to use in place of space for html tags or xml tags. Please accept as answer or award point if this works for you.

in the case of your token tag, change it to

<set token="some_token">&#32;</set>
0 Karma

jeffland
SplunkTrust
SplunkTrust

As I've already said in my question, &#32; behaves just like space, so this doesn't work either.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi jeffland,
use | lookup " as prefix and " inputfield inputfield2 OUTPUTNEW field2 as suffix.
Bye.
Giuseppe

jeffland
SplunkTrust
SplunkTrust

Cool, this actually does the trick for case 1 (you can put the name of the lookup in double quotes) - thanks for the suggestion!
It still doesn't fix the problems when setting a token explicitly or using a space character for an options value.

0 Karma

gcusello
SplunkTrust
SplunkTrust

try in the same way.
Bye.
Giuseppe

0 Karma

jeffland
SplunkTrust
SplunkTrust

That won't work, I can't just add double quotes randomly somewhere in my search. Or maybe I didn't get how you want to do it in the following situation:

<input type="dropdown" token="filter_tok" searchWhenChanged="true">
  <label>Filter</label>
  <choice value="| where foo>0">Filter foo</choice>
  <choice value=" ">Don't filter foo</choice>
  ...
<search>
  <query>source=baz | stats foo $filter_tok$</query>
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi jeffland,
Sorry, I didn't understand the second part of the problem!
There isn't a direct solution because it isn't possible to set a null value to a token, you could use a workaround (or better "a porkaround") inserting a condition always true like | where 1=1 or | search index=*.
Bye.
Giuseppe

0 Karma

jeffland
SplunkTrust
SplunkTrust

Yeah, I've also used | noop in the past, but it just doesn't feel right. I was looking for a proper solution, but maybe there is none (yet). Thanks for your input nonetheless!

0 Karma

cmerriman
Super Champion

try this: a space in the value and two spaces in the suffix before inputfield. it worked in a test dashboard.

  <input type="multiselect" token="lookup_tok" searchWhenChanged="true">
    <label>Geofences</label>
    <choice value=" lookup_a">A</choice>
    <choice value=" lookup_b">B</choice>
    <default>A</default>
    <valuePrefix>| lookup</valuePrefix>
    <valueSuffix>  inputfield inputfield2 OUTPUTNEW field2</valueSuffix>
    <delimiter> </delimiter>
  </input>

OR two spaces after the prefix and two spaces before the suffix

 <input type="multiselect" token="lookup_tok" searchWhenChanged="true">
    <label>Geofences</label>
    <choice value="lookup_a">A</choice>
    <choice value="lookup_b">B</choice>
    <default>A</default>
    <valuePrefix>| lookup  </valuePrefix>
    <valueSuffix>  inputfield inputfield2 OUTPUTNEW field2</valueSuffix>
    <delimiter> </delimiter>
  </input>

my output was | lookup lookup_a inputfield inputfield2 OUTPUTNEW field2

0 Karma

jeffland
SplunkTrust
SplunkTrust

Unfortunately, this results in the same behavior as a single space character. You'll notice that when you a) set those two spaces in Simple XML (you still can't set them in the UI) b) change something on the dashboard in the UI and c) re-open the dashboard.

0 Karma

james_hopton
New Member

We are having a similar issue. our spaces will save initially, but after some amount of time and/or editing, the spaces around certain characters are removed.

Most often modified example:
We use something similar to "|fields - Field1,Field2" in a dashboard query. Every so often the spaces are removed making the command not work. e.g. "|fields-Field1,Field2"

Would be glad to help troubleshoot if someone has steps.

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...