How are strings from an UI-"input" interpreted in another string search?

[GaryZ]

I have the following search string in my chart panel.  

"Arguments.category{}"= "$TestSuite$"

TestSuite is defined by the following dropdown UI-Input.  

| stats count by test_suite
| fields test_suite

My question is when I use this string

"Arguments.category{}"= "$TestSuite$"

The output returns this search

"Arguments.category{}"= "(backend/resource_ql)"

I  am interested in getting this (without the parenthesis). 

"Arguments.category{}"= "backend/resource_ql"

What am I doing wrong?  Thanks in advance.

[woodcock]

You are using the wrong syntax in your "where".  IMHO it should be:
| search Arguments.category() = "$TestSuite$"

| makeresults 
| eval "Arguments.category{}" = "xxx"
| rename * AS *{}
| search "Arguments.category{}" = "xxx"
| search Arguments.category{} = "xxx"
| where 'Arguments.category{}' = "xxx"

TestSuite 

[GaryZ]

@woodcock 

Would this be the same if I'm using either a dropdown vs. multi-select input?

I used the following for the multi-select case

where 'Arguments.category{}' IN $TestSuite$

I was then using  the following when I was using the dropdown. 

where 'Arguments.category{}' = "xxx"

However my issue is what's interpreted when I'm using either input types.

When I use this search string

"Arguments.category{}"= "$TestSuite$"

The output returns this search (with the parenthesis)

"Arguments.category{}"= "(backend/abc)"

I  am interested in getting this (without the parenthesis). 

"Arguments.category{}"= "backend/abc"

I'm curious if there's something I'm missing (or doing wrong) when I'm setting up the input UIs.   

[woodcock]

(redacted)  You posted "dropdown", not "multiselect".  (redacted)

[GaryZ]

@woodcock 

Ideally I want multi-select.  I do understand the syntax in the dropdown.  however, the issue I'm having is the interpretation I'm getting in the search string when I'm using either of the case - dropdown or multi-select. 

Sorry for these newby questions.  I'm fairly new to Splunk, and have a lot to learn.  Thank you for being patient.

[woodcock]

This is the stuff you need:
<label>TestSuite</label>
<prefix>Arguments.category{} IN(</prefix>
<suffix>)</suffix>
<valuePrefix>"</valuePrefix>
<valueSuffix>"</valueSuffix>
<delimiter>,</delimiter>

Then just use "| search $TestSuite$"

[GaryZ]

hello @yeahnah 

This is the code (redacted) that generated the input.  Please let me know if you any more information.  Thanks.

<input type="dropdown" token="TestSuite" searchWhenChanged="true">
      <label>TestSuite</label>
      <default>backend/abc</default>
      <initialValue>backend/abc</initialValue>
      <fieldForLabel>test_suite</fieldForLabel>
      <fieldForValue>test_suite</fieldForValue>
      <search>
        <query>index=service_index 
| rename "Arguments.category{}" as test_suite
| stats count by test_suite
| fields test_suite</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
      <prefix>"</prefix>
      <suffix>"</suffix>
    </input>

This is the code that's using the input from $TestSuite$

  <row>
    <panel>
      <chart>
        <title>Test Status (24Hrs)</title>
        <search>
          <query>index=service_index 
| where "Arguments.category{}" IN $TestSuite$
| stats count by Status</query>
          <earliest>$timeRange.earliest$</earliest>
          <latest>$timeRange.latest$</latest>
        </search>
        <option name="charting.chart">pie</option>
        <option name="charting.drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </chart>
    </panel>
  </row>

[yeahnah]

Hi @GaryZ 

It would be easier to check if you provide the dashboard source XML, in case there is something strange going on there.  Please post the source XML inside a code sample block.