Dashboards & Visualizations

Why does a panel in my dashboard form report "Search is waiting for input..." when the search that powers that panel includes two aliased return fields?

RJ_Grayson
Path Finder

I'm trying to create a dashboard form with a text input box that populates a token that is used in a number of searches on the dashboard. I recently created a new panel on the dashboard and could not get it to work using the tokens from the text input.

After some trial and error I found that the search doesn't want to start when the subsearch attempts to return two aliased fields. Here is what my search looks like:

index=myindex [|inputlookup MyLookup.csv.gz | search Field=$token1$ | return customField1=$FieldA customField2=$FieldA]

If I remove one of the aliased fields from the return command in the subsearch the search starts without issue and finishes. If I keep both aliased fields in the rerturn command as seen above the search never starts after inputting data in the text box. The rest of the panels on the dashboard will load but this panel will just sit there stating "Search is waiting for input...". If I run this search with a hardcoded value where the token is in a regular search window I have no problem running the search and it returns the results I want.

Can you not return two aliased fields in a subsearch when it is part of a dashboard form or is this a bug? Has anyone else had this issue? I'm currently running 6.5.1 on the Search Head.

0 Karma
1 Solution

woodcock
Esteemed Legend

You are correct about the cause. To fix, edit the source XML and change all of your non-dashboard-token dollar-signs ('$') to double-dollar-signs ('$$'), like this: $$FieldA

View solution in original post

woodcock
Esteemed Legend

Another way to handle this is with Character Data clause, better known as CDATA:

https://stackoverflow.com/questions/2784183/what-does-cdata-in-xml-mean

0 Karma

woodcock
Esteemed Legend

You are correct about the cause. To fix, edit the source XML and change all of your non-dashboard-token dollar-signs ('$') to double-dollar-signs ('$$'), like this: $$FieldA

RJ_Grayson
Path Finder

This did the trick. I looked all over the docs regarding this issue before posting here. Can you explain why the double-dollar-signs are necessary in this particular circumstance? Is this referenced anywhere in the documentation?

Thanks for the help!

0 Karma

woodcock
Esteemed Legend

You are telling the XML parser to skip over (escape) it. The XML parser, and map and return and tokens (and ???) use dollar-signs as special characters so you need to make sure it gets handled by the right parser.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...