- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: Dropdown input panel: Search is not changing a...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
So I created a dropdown input panel for weekwise but my search is not changing as per dropdown selection -
...
weekEnding
All
weekEnding
weekEnding
<query>index=db_compliance_audit| top limit=20 weekEnding</query>
<earliest>0</earliest>
<latest></latest>
<panel>
<title>Host Summary Dashboard</title>
<table>
<search>
<query>index=db_compliance_audit weekEnding = $weekEnding$ | xyseries hostname compName status</query>
<earliest>0</earliest>
<latest></latest>
</search>
<option name="count">10</option>
<option name="drilldown">row</option>
<option name="percentagesRow">false</option>
<option name="refresh.display">progressbar</option>
<option name="totalsRow">false</option>
<format type="color" field="Failed">
<colorPalette type="list">[#DC4E41]</colorPalette>
<scale type="threshold"></scale>
</format>
<format type="color" field="Passed">
<colorPalette type="list">[#53A051,#DC4E41]</colorPalette>
<scale type="threshold">100</scale>
</format>
<format type="number" field="Passed"></format>
<format type="number" field="percentage"></format>
<format type="color" field="percentage">
<colorPalette type="minMidMax" maxColor="#53A051" minColor="#DC4E41"></colorPalette>
<scale type="minMidMax"></scale>
</format>
<drilldown>
<set token="field1">$row.field1$</set>
<set token="form.field1">$row.field1$</set>
</drilldown>
</table>......
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@rashi83 while posting code/data use the code button (101010 or Ctrl+K) on Splunk Answer so that special characters do not escape. You dropdown code needs to be posted again as is missing in your current question.
In order to enforce token as String have you tried any of the following in the Splunk search query?
weekEnding = $weekEnding|s$
Or
weekEnding = "$weekEnding$"
In order to debug SPL with tokens you can also create HTML panel with SPL and run the search after tokens are resolved in a new Search window to confirm the expected behavior.
<row>
<panel>
<html>
<div>index=db_compliance_audit weekEnding = $weekEnding|s$ | xyseries hostname compName status</div>
</html>
</panel>
</row>
PS: Is your use case really to run all time search?
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@rashi83 while posting code/data use the code button (101010 or Ctrl+K) on Splunk Answer so that special characters do not escape. You dropdown code needs to be posted again as is missing in your current question.
In order to enforce token as String have you tried any of the following in the Splunk search query?
weekEnding = $weekEnding|s$
Or
weekEnding = "$weekEnding$"
In order to debug SPL with tokens you can also create HTML panel with SPL and run the search after tokens are resolved in a new Search window to confirm the expected behavior.
<row>
<panel>
<html>
<div>index=db_compliance_audit weekEnding = $weekEnding|s$ | xyseries hostname compName status</div>
</html>
</panel>
</row>
PS: Is your use case really to run all time search?
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks, my code had worked. Matter of closing the currnet session and opening a new one.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@rashi83, do accept the answer to mark this question as answered!
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@rashi83 Did you try using quotes. weekEnding = "$weekEnding$". Also where and how are you setting the token for weekEnding.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If I use quotes $weekending$ then entire dropdown disappears. TOken calue is set as field1 in the above xml
Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer at Splunk .conf24 ...
Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...
Combine Multiline Logs into a Single Event with SOCK: a Step-by-Step Guide for ...
