Splunk Enterprise

Dynamic Dropdown input option token values with multipart strings issue

Mikulee
New Member

Hi,

I've had this issue before, but now I have to visit this again.

I dont know how to manipulate the token value in such a way, that I can use it in a dashboard panel search, when there is are multipart values in the token.

The setup:

1. I have a dashboard with multiple panels, with different searches
2. Then there is dropdown inputs for time and one to filter the data to a subset.

Problem is when the data filter input uses a search to populate the token AND WHEN the values are multipart, like "Active Directory Domain Services", or anything that's not single string.
Then when that token , like "Role_Name" is used to filter the panel, like :

index=* Type=Role Name=$Role_Name$

It does not get any results AS the Token values should be inside quotes, single or double.

So how do I concatenate quotes in to the search or should I preprosess the token value inside the search with some evals ?



 

 

Labels (1)
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Manage Edge Processor pipelines end to end with APIs

This guide uses the Data Management APIs to create an Edge Processor, onboard one instance, deploy a pipeline ...

Splunk Brings Proof of Control to Digital Asset Transfers

Digital assets now sit inside the core of financial services. HSBC launched its Tokenized Deposit Service in ...

Manage Ingest Processor pipelines end to end with APIs

This guide uses the Data Management APIs to create an Ingest Processor pipeline, deploy it to the ...