So I created a dropdown input panel for weekwise but my search is not changing as per dropdown selection -
...
weekEnding
All
weekEnding
weekEnding
<query>index=db_compliance_audit| top limit=20 weekEnding</query>
<earliest>0</earliest>
<latest></latest>
<panel>
<title>Host Summary Dashboard</title>
<table>
<search>
<query>index=db_compliance_audit weekEnding = $weekEnding$ | xyseries hostname compName status</query>
<earliest>0</earliest>
<latest></latest>
</search>
<option name="count">10</option>
<option name="drilldown">row</option>
<option name="percentagesRow">false</option>
<option name="refresh.display">progressbar</option>
<option name="totalsRow">false</option>
<format type="color" field="Failed">
<colorPalette type="list">[#DC4E41]</colorPalette>
<scale type="threshold"></scale>
</format>
<format type="color" field="Passed">
<colorPalette type="list">[#53A051,#DC4E41]</colorPalette>
<scale type="threshold">100</scale>
</format>
<format type="number" field="Passed"></format>
<format type="number" field="percentage"></format>
<format type="color" field="percentage">
<colorPalette type="minMidMax" maxColor="#53A051" minColor="#DC4E41"></colorPalette>
<scale type="minMidMax"></scale>
</format>
<drilldown>
<set token="field1">$row.field1$</set>
<set token="form.field1">$row.field1$</set>
</drilldown>
</table>......
@rashi83 while posting code/data use the code button (101010 or Ctrl+K)
on Splunk Answer so that special characters do not escape. You dropdown code needs to be posted again as is missing in your current question.
In order to enforce token as String have you tried any of the following in the Splunk search query?
weekEnding = $weekEnding|s$
Or
weekEnding = "$weekEnding$"
In order to debug SPL with tokens you can also create HTML panel with SPL and run the search after tokens are resolved in a new Search window to confirm the expected behavior.
<row>
<panel>
<html>
<div>index=db_compliance_audit weekEnding = $weekEnding|s$ | xyseries hostname compName status</div>
</html>
</panel>
</row>
PS: Is your use case really to run all time search?
@rashi83 while posting code/data use the code button (101010 or Ctrl+K)
on Splunk Answer so that special characters do not escape. You dropdown code needs to be posted again as is missing in your current question.
In order to enforce token as String have you tried any of the following in the Splunk search query?
weekEnding = $weekEnding|s$
Or
weekEnding = "$weekEnding$"
In order to debug SPL with tokens you can also create HTML panel with SPL and run the search after tokens are resolved in a new Search window to confirm the expected behavior.
<row>
<panel>
<html>
<div>index=db_compliance_audit weekEnding = $weekEnding|s$ | xyseries hostname compName status</div>
</html>
</panel>
</row>
PS: Is your use case really to run all time search?
Thanks, my code had worked. Matter of closing the currnet session and opening a new one.
@rashi83, do accept the answer to mark this question as answered!
@rashi83 Did you try using quotes. weekEnding = "$weekEnding$". Also where and how are you setting the token for weekEnding.
If I use quotes $weekending$ then entire dropdown disappears. TOken calue is set as field1 in the above xml