Splunk Search

Dashboard Studio : DataSource gets results. MultiSelect token used in Chain search. Spaces in DS result no go.

GEO
Engager

Good Day Ladies, Gentlemen!

It's my first Dashboard Studio experience, and one (1) space boggles me.

I have a datasource that works :

 

 

 

"ds_teamList": {
	"type": "ds.search",
	"options": {
	"query": "host=\"splunk.cxm\" index=\"jira\" sourcetype=\"csv\" \"Project name\"=\"_9010 RD\" \n| rename \"Custom field __Team\" as TEAM\n| table TEAM\n| dedup TEAM \n| sort TEAM"
	},
	"name": "teamList"
}

 

 

 

A multiselect input that list the correct data: With one (1) team name containing spaces.

 

 

 

"input_TEAM": {
	"options": {
	"items": [{}],
	"token": "ms_Team",
	"clearDefaultOnSelection": true,
	"selectFirstSearchResult": true
	},
	"title": "TEAM",
	"type": "input.multiselect",
	"dataSources": {
		"primary": "ds_teamList"
}

 

 

 


A chain search that uses the ms_team token:

 

 

 

| search TEAM IN ($ms_Team$)
| search CLIENT IN ($dd_Client$)
| search Priority IN ($ms_priority$)
| chart count over Status by TEAM

 

 

 


The result gets all good data, but for the team that have a space in its name:
splunk_Space.png

 

I know that if I could add double quotes for the team with space, it would work, but cannot find a solution for this simple minus issue. Or this is a bug, or not the way I'm suppose to use Dashboard Studio.

 

 

 

| search TEAM IN (Detector,Electronic,Mechanical,Software,"Thin film")

 

 

 


I searched and tried many solutions about strings in token, search... then I'm here for the first time... 

Any simple solution possible?

Thank you!
Sylvain

Labels (2)
0 Karma

GEO
Engager

I guess it's a Dashboard Studio issue ...
Just updated from 8.2 to 9.1.1.

I will try to see if that works.

0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...