Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Dropdown input panel: Search is not changing as pe...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
So I created a dropdown input panel for weekwise but my search is not changing as per dropdown selection -
...
weekEnding
All
weekEnding
weekEnding
<query>index=db_compliance_audit| top limit=20 weekEnding</query>
<earliest>0</earliest>
<latest></latest>
<panel>
<title>Host Summary Dashboard</title>
<table>
<search>
<query>index=db_compliance_audit weekEnding = $weekEnding$ | xyseries hostname compName status</query>
<earliest>0</earliest>
<latest></latest>
</search>
<option name="count">10</option>
<option name="drilldown">row</option>
<option name="percentagesRow">false</option>
<option name="refresh.display">progressbar</option>
<option name="totalsRow">false</option>
<format type="color" field="Failed">
<colorPalette type="list">[#DC4E41]</colorPalette>
<scale type="threshold"></scale>
</format>
<format type="color" field="Passed">
<colorPalette type="list">[#53A051,#DC4E41]</colorPalette>
<scale type="threshold">100</scale>
</format>
<format type="number" field="Passed"></format>
<format type="number" field="percentage"></format>
<format type="color" field="percentage">
<colorPalette type="minMidMax" maxColor="#53A051" minColor="#DC4E41"></colorPalette>
<scale type="minMidMax"></scale>
</format>
<drilldown>
<set token="field1">$row.field1$</set>
<set token="form.field1">$row.field1$</set>
</drilldown>
</table>......
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@rashi83 while posting code/data use the code button (101010 or Ctrl+K) on Splunk Answer so that special characters do not escape. You dropdown code needs to be posted again as is missing in your current question.
In order to enforce token as String have you tried any of the following in the Splunk search query?
weekEnding = $weekEnding|s$
Or
weekEnding = "$weekEnding$"
In order to debug SPL with tokens you can also create HTML panel with SPL and run the search after tokens are resolved in a new Search window to confirm the expected behavior.
<row>
<panel>
<html>
<div>index=db_compliance_audit weekEnding = $weekEnding|s$ | xyseries hostname compName status</div>
</html>
</panel>
</row>
PS: Is your use case really to run all time search?
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@rashi83 while posting code/data use the code button (101010 or Ctrl+K) on Splunk Answer so that special characters do not escape. You dropdown code needs to be posted again as is missing in your current question.
In order to enforce token as String have you tried any of the following in the Splunk search query?
weekEnding = $weekEnding|s$
Or
weekEnding = "$weekEnding$"
In order to debug SPL with tokens you can also create HTML panel with SPL and run the search after tokens are resolved in a new Search window to confirm the expected behavior.
<row>
<panel>
<html>
<div>index=db_compliance_audit weekEnding = $weekEnding|s$ | xyseries hostname compName status</div>
</html>
</panel>
</row>
PS: Is your use case really to run all time search?
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks, my code had worked. Matter of closing the currnet session and opening a new one.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@rashi83, do accept the answer to mark this question as answered!
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@rashi83 Did you try using quotes. weekEnding = "$weekEnding$". Also where and how are you setting the token for weekEnding.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If I use quotes $weekending$ then entire dropdown disappears. TOken calue is set as field1 in the above xml
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas
What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)
Automating Threat Operations and Threat Hunting with Recorded Future
