Splunk Search

Dashboard Studio : DataSource gets results. MultiSelect token used in Chain search. Spaces in DS result no go.

GEO
Engager

Good Day Ladies, Gentlemen!

It's my first Dashboard Studio experience, and one (1) space boggles me.

I have a datasource that works :

 

 

 

"ds_teamList": {
	"type": "ds.search",
	"options": {
	"query": "host=\"splunk.cxm\" index=\"jira\" sourcetype=\"csv\" \"Project name\"=\"_9010 RD\" \n| rename \"Custom field __Team\" as TEAM\n| table TEAM\n| dedup TEAM \n| sort TEAM"
	},
	"name": "teamList"
}

 

 

 

A multiselect input that list the correct data: With one (1) team name containing spaces.

 

 

 

"input_TEAM": {
	"options": {
	"items": [{}],
	"token": "ms_Team",
	"clearDefaultOnSelection": true,
	"selectFirstSearchResult": true
	},
	"title": "TEAM",
	"type": "input.multiselect",
	"dataSources": {
		"primary": "ds_teamList"
}

 

 

 


A chain search that uses the ms_team token:

 

 

 

| search TEAM IN ($ms_Team$)
| search CLIENT IN ($dd_Client$)
| search Priority IN ($ms_priority$)
| chart count over Status by TEAM

 

 

 


The result gets all good data, but for the team that have a space in its name:
splunk_Space.png

 

I know that if I could add double quotes for the team with space, it would work, but cannot find a solution for this simple minus issue. Or this is a bug, or not the way I'm suppose to use Dashboard Studio.

 

 

 

| search TEAM IN (Detector,Electronic,Mechanical,Software,"Thin film")

 

 

 


I searched and tried many solutions about strings in token, search... then I'm here for the first time... 

Any simple solution possible?

Thank you!
Sylvain

Labels (2)
0 Karma

GEO
Engager

I guess it's a Dashboard Studio issue ...
Just updated from 8.2 to 9.1.1.

I will try to see if that works.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Automated Threat Analysis: Available in ES Premier

Automated Threat Analysis: Centralize and Accelerate Phishing Investigations in Splunk Enterprise ...

What’s New in Splunk AI: Volume 02

Welcome to the second edition of “What’s New in Splunk AI” where we look at the latest and greatest updates, ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...