Hello,
Anyone have any idea why a dropdown filter would only show results for one word field result? I need the dropdown to work with field results of more than one word.
Need as little more information to work with here...
I am guessing that this could be something to do with quoting, i.e. if you want to search for a drop down phrase
hello world
and your token is my_choice, then in your search, if you are using
search... my_field=$my_choice$
then Splunk will be searching
my_field=hello world
and you want it to search
my_field="hello world"
so to do that, you should use the |s token suffix, which instructs Splunk to quote the result, i.e.
search... my_field=$my_choice|s$
bowesmana,
Thanks for the solution. Worked like a charm!
Need as little more information to work with here...
I am guessing that this could be something to do with quoting, i.e. if you want to search for a drop down phrase
hello world
and your token is my_choice, then in your search, if you are using
search... my_field=$my_choice$
then Splunk will be searching
my_field=hello world
and you want it to search
my_field="hello world"
so to do that, you should use the |s token suffix, which instructs Splunk to quote the result, i.e.
search... my_field=$my_choice|s$