Splunk Search
Highlighted

Dropdown input panel: Search is not changing as per dropdown selection

Explorer

So I created a dropdown input panel for weekwise but my search is not changing as per dropdown selection -

...

weekEnding
All
weekEnding
weekEnding

<query>index=db_compliance_audit| top limit=20 weekEnding</query>
<earliest>0</earliest>
<latest></latest>





<panel>
  <title>Host Summary Dashboard</title>
  <table>
    <search>
      <query>index=db_compliance_audit weekEnding = $weekEnding$ | xyseries hostname compName status</query>
      <earliest>0</earliest>
      <latest></latest>
    </search>
    <option name="count">10</option>
    <option name="drilldown">row</option>
    <option name="percentagesRow">false</option>
    <option name="refresh.display">progressbar</option>
    <option name="totalsRow">false</option>
    <format type="color" field="Failed">
      <colorPalette type="list">[#DC4E41]</colorPalette>
      <scale type="threshold"></scale>
    </format>
    <format type="color" field="Passed">
      <colorPalette type="list">[#53A051,#DC4E41]</colorPalette>
      <scale type="threshold">100</scale>
    </format>
    <format type="number" field="Passed"></format>
    <format type="number" field="percentage"></format>
    <format type="color" field="percentage">
      <colorPalette type="minMidMax" maxColor="#53A051" minColor="#DC4E41"></colorPalette>
      <scale type="minMidMax"></scale>
    </format>
    <drilldown>
      <set token="field1">$row.field1$</set>
      <set token="form.field1">$row.field1$</set>
    </drilldown>
  </table>......
Highlighted

Re: Dropdown input panel: Search is not changing as per dropdown selection

Influencer

@rashi83 Did you try using quotes. weekEnding = "$weekEnding$". Also where and how are you setting the token for weekEnding.

0 Karma
Highlighted

Re: Dropdown input panel: Search is not changing as per dropdown selection

Explorer

If I use quotes $weekending$ then entire dropdown disappears. TOken calue is set as field1 in the above xml

0 Karma
Highlighted

Re: Dropdown input panel: Search is not changing as per dropdown selection

Legend

@rashi83 while posting code/data use the code button (101010 or Ctrl+K) on Splunk Answer so that special characters do not escape. You dropdown code needs to be posted again as is missing in your current question.

In order to enforce token as String have you tried any of the following in the Splunk search query?

weekEnding = $weekEnding|s$

Or

weekEnding = "$weekEnding$"

In order to debug SPL with tokens you can also create HTML panel with SPL and run the search after tokens are resolved in a new Search window to confirm the expected behavior.

<row>
    <panel>
        <html>
            <div>index=db_compliance_audit weekEnding = $weekEnding|s$ | xyseries hostname compName status</div>
        </html>
    </panel>
</row>

PS: Is your use case really to run all time search?




| eval message="Happy Splunking!!!"


View solution in original post

Highlighted

Re: Dropdown input panel: Search is not changing as per dropdown selection

Explorer

Thanks, my code had worked. Matter of closing the currnet session and opening a new one.

0 Karma
Highlighted

Re: Dropdown input panel: Search is not changing as per dropdown selection

Legend

@rashi83, do accept the answer to mark this question as answered!




| eval message="Happy Splunking!!!"


0 Karma