Splunk Enterprise

Dynamic Dropdown input option token values with multipart strings issue

Mikulee
New Member

Hi,

I've had this issue before, but now I have to visit this again.

I dont know how to manipulate the token value in such a way, that I can use it in a dashboard panel search, when there is are multipart values in the token.

The setup:

1. I have a dashboard with multiple panels, with different searches
2. Then there is dropdown inputs for time and one to filter the data to a subset.

Problem is when the data filter input uses a search to populate the token AND WHEN the values are multipart, like "Active Directory Domain Services", or anything that's not single string.
Then when that token , like "Role_Name" is used to filter the panel, like :

index=* Type=Role Name=$Role_Name$

It does not get any results AS the Token values should be inside quotes, single or double.

So how do I concatenate quotes in to the search or should I preprosess the token value inside the search with some evals ?



 

 

Labels (1)
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Data Outage Monitoring and Reporting

We’ve all been there, right? Living our best life, working on our Splunk environment, when out of nowhere a ...

Manage Datasets and Connections in Catalog on Splunk Cloud Platform

Set Up Data Where You Use It Catalog already helps teams find and understand data across Splunk indexes, ...

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Splunk introduced persistent queueing at the tcpout layer as one of the most practical resilience features in ...