Why is 2nd dropdown populated correctly, but events table is not updating?

[junmun-chan]

Hi,

This is a follow-up to my previous question. Now, I am trying to add a second drop-down. The values populated are correct, but my events table is not updating. Is there some errors in my codes?

    <panel>
      <title>Error Log</title>
      <input type="dropdown" token="ProfileLog" searchWhenChanged="true">
        <label>Module</label>
        <fieldForLabel>ESPACE_NAME</fieldForLabel>
        <fieldForValue>ESPACE_NAME</fieldForValue>
        <search base="baseSearch">
          <query>| stats count by ESPACE_NAME</query>
        </search>
        <choice value="*">All</choice>
        <default>*</default>
        <initialValue>*</initialValue>
      </input>
      <input type="dropdown" token="MessageLog" searchWhenChanged="true">
        <label>Error Message</label>
        <search base="baseSearch">
          <query>| search ESPACE_NAME="$ProfileLog$" | stats count by MESSAGE</query>
        </search>
        <default>*</default>
        <fieldForLabel>MESSAGE</fieldForLabel>
        <fieldForValue>MESSAGE</fieldForValue>
        <choice value="*">All</choice>
        <initialValue>*</initialValue>
      </input>
      <event>
        <search base="baseSearch">
          <query>| search ESPACE_NAME="$ProfileLog$"</query>
        </search>
        <option name="list.drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </event>
    </panel>

Thanks!

[bowesmana · Accepted solution]

You are missing the use of the MessageLog token in your search in your search panel.

Your search in the final panel should be

<query>| search ESPACE_NAME="$ProfileLog$" MESSAGE=$MessageLog|s$</query>

Note the subtle difference of quoting the token vs using $token|s$ which tells Splunk to quote it correctly for you.

[junmun-chan]

Thank you! it works 😄