Splunk Dev

Why is dropdown not working with basesearch?

junmun-chan
Explorer

Hi, 

I have created a base search, and have an event table to display the results. Problem is, only the 'All' value is working correctly. When i select other options, nothing is being display. The dropdown is showing me the correct options.  Below is my codes, i have changed some of the words, as i can't use the actual data here.

 

This is my base search, i have set it up at the top

 

 

<form theme="dark">
  <label>Profiles</label>
  <search id="baseSearch">
    <query>source="ErrorLog" ESPACE_NAME IN (Customer, Vendors, Friends) | replace "Customer" WITH "Customer Name", "Vendors" with "Vendors Name", "Friends" WITH "Friends Name" IN ESPACE_NAME</query>
    <earliest>$field1.earliest$</earliest>
    <latest>$field1.latest$</latest>
    <refresh>5m</refresh>
    <refreshType>delay</refreshType>
  </search>
  <fieldset submitButton="false" autoRun="true">
    <input type="time" token="field1">
      <label></label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>

 

 

 

 This is the codes for my dropdown

 

 

    <panel>
      <title>Error Log</title>
      <input type="dropdown" token="ProfileLog" searchWhenChanged="true">
        <label>Module</label>
        <fieldForLabel>ESPACE_NAME</fieldForLabel>
        <fieldForValue>ESPACE_NAME</fieldForValue>
        <search base="baseSearch">
          <query>| stats count by ESPACE_NAME</query>
        </search>
        <choice value="*">All</choice>
        <default>*</default>
        <initialValue>*</initialValue>
      </input>
      <event>
        <search base="baseSearch">
          <query>| search ESPACE_NAME=$ProfileLog$</query>
        </search>
        <option name="list.drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </event>
    </panel>
  </row>
</form>

 

 

 

Any assistance is appreciated!! Thank you

Labels (1)
Tags (2)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

Hi @junmun-chan,

Since your token values contains spaces you have use tokens between double-quotes like below;

    <panel>
      <title>Error Log</title>
      <input type="dropdown" token="ProfileLog" searchWhenChanged="true">
        <label>Module</label>
        <fieldForLabel>ESPACE_NAME</fieldForLabel>
        <fieldForValue>ESPACE_NAME</fieldForValue>
        <search base="baseSearch">
          <query>| stats count by ESPACE_NAME</query>
        </search>
        <choice value="*">All</choice>
        <default>*</default>
        <initialValue>*</initialValue>
      </input>
      <event>
        <search base="baseSearch">
          <query>| search ESPACE_NAME="$ProfileLog$"</query>
        </search>
        <option name="list.drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </event>
    </panel>
  </row>
</form>
If this reply helps you an upvote and "Accept as Solution" is appreciated.

View solution in original post

0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @junmun-chan,

Since your token values contains spaces you have use tokens between double-quotes like below;

    <panel>
      <title>Error Log</title>
      <input type="dropdown" token="ProfileLog" searchWhenChanged="true">
        <label>Module</label>
        <fieldForLabel>ESPACE_NAME</fieldForLabel>
        <fieldForValue>ESPACE_NAME</fieldForValue>
        <search base="baseSearch">
          <query>| stats count by ESPACE_NAME</query>
        </search>
        <choice value="*">All</choice>
        <default>*</default>
        <initialValue>*</initialValue>
      </input>
      <event>
        <search base="baseSearch">
          <query>| search ESPACE_NAME="$ProfileLog$"</query>
        </search>
        <option name="list.drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </event>
    </panel>
  </row>
</form>
If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

junmun-chan
Explorer

Oh yes scelikok, it works now!

 

Thank you!!

0 Karma
Get Updates on the Splunk Community!

Index This | I’m short for "configuration file.” What am I?

May 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with a Special ...

New Articles from Academic Learning Partners, Help Expand Lantern’s Use Case Library, ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...