Splunk Search

Dashboard Studio : DataSource gets results. MultiSelect token used in Chain search. Spaces in DS result no go.

GEO
Engager

Good Day Ladies, Gentlemen!

It's my first Dashboard Studio experience, and one (1) space boggles me.

I have a datasource that works :

 

 

 

"ds_teamList": {
	"type": "ds.search",
	"options": {
	"query": "host=\"splunk.cxm\" index=\"jira\" sourcetype=\"csv\" \"Project name\"=\"_9010 RD\" \n| rename \"Custom field __Team\" as TEAM\n| table TEAM\n| dedup TEAM \n| sort TEAM"
	},
	"name": "teamList"
}

 

 

 

A multiselect input that list the correct data: With one (1) team name containing spaces.

 

 

 

"input_TEAM": {
	"options": {
	"items": [{}],
	"token": "ms_Team",
	"clearDefaultOnSelection": true,
	"selectFirstSearchResult": true
	},
	"title": "TEAM",
	"type": "input.multiselect",
	"dataSources": {
		"primary": "ds_teamList"
}

 

 

 


A chain search that uses the ms_team token:

 

 

 

| search TEAM IN ($ms_Team$)
| search CLIENT IN ($dd_Client$)
| search Priority IN ($ms_priority$)
| chart count over Status by TEAM

 

 

 


The result gets all good data, but for the team that have a space in its name:
splunk_Space.png

 

I know that if I could add double quotes for the team with space, it would work, but cannot find a solution for this simple minus issue. Or this is a bug, or not the way I'm suppose to use Dashboard Studio.

 

 

 

| search TEAM IN (Detector,Electronic,Mechanical,Software,"Thin film")

 

 

 


I searched and tried many solutions about strings in token, search... then I'm here for the first time... 

Any simple solution possible?

Thank you!
Sylvain

Labels (2)
0 Karma

GEO
Engager

I guess it's a Dashboard Studio issue ...
Just updated from 8.2 to 9.1.1.

I will try to see if that works.

0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...