Splunk Search

Dashboard Studio : DataSource gets results. MultiSelect token used in Chain search. Spaces in DS result no go.

GEO
Engager

Good Day Ladies, Gentlemen!

It's my first Dashboard Studio experience, and one (1) space boggles me.

I have a datasource that works :

 

 

 

"ds_teamList": {
	"type": "ds.search",
	"options": {
	"query": "host=\"splunk.cxm\" index=\"jira\" sourcetype=\"csv\" \"Project name\"=\"_9010 RD\" \n| rename \"Custom field __Team\" as TEAM\n| table TEAM\n| dedup TEAM \n| sort TEAM"
	},
	"name": "teamList"
}

 

 

 

A multiselect input that list the correct data: With one (1) team name containing spaces.

 

 

 

"input_TEAM": {
	"options": {
	"items": [{}],
	"token": "ms_Team",
	"clearDefaultOnSelection": true,
	"selectFirstSearchResult": true
	},
	"title": "TEAM",
	"type": "input.multiselect",
	"dataSources": {
		"primary": "ds_teamList"
}

 

 

 


A chain search that uses the ms_team token:

 

 

 

| search TEAM IN ($ms_Team$)
| search CLIENT IN ($dd_Client$)
| search Priority IN ($ms_priority$)
| chart count over Status by TEAM

 

 

 


The result gets all good data, but for the team that have a space in its name:
splunk_Space.png

 

I know that if I could add double quotes for the team with space, it would work, but cannot find a solution for this simple minus issue. Or this is a bug, or not the way I'm suppose to use Dashboard Studio.

 

 

 

| search TEAM IN (Detector,Electronic,Mechanical,Software,"Thin film")

 

 

 


I searched and tried many solutions about strings in token, search... then I'm here for the first time... 

Any simple solution possible?

Thank you!
Sylvain

Labels (2)
0 Karma

GEO
Engager

I guess it's a Dashboard Studio issue ...
Just updated from 8.2 to 9.1.1.

I will try to see if that works.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...