Splunk Search

How are strings from an UI-"input" interpreted in another string search?

GaryZ
Path Finder

I have the following search string in my chart panel.  

"Arguments.category{}"= "$TestSuite$"

 

TestSuite is defined by the following dropdown UI-Input.  

| stats count by test_suite
| fields test_suite

GaryZ_0-1681761643103.png

 

My question is when I use this string

"Arguments.category{}"= "$TestSuite$"

 

The output returns this search

"Arguments.category{}"= "(backend/resource_ql)"

 

I  am interested in getting this (without the parenthesis). 

"Arguments.category{}"= "backend/resource_ql"

 

What am I doing wrong?  Thanks in advance.

Labels (4)
0 Karma

woodcock
Esteemed Legend

You are using the wrong syntax in your "where".  IMHO it should be:
| search Arguments.category() = "$TestSuite$"

| makeresults 
| eval "Arguments.category{}" = "xxx"
| rename * AS *{}
| search "Arguments.category{}" = "xxx"
| search Arguments.category{} = "xxx"
| where 'Arguments.category{}' = "xxx"

TestSuite 

0 Karma

GaryZ
Path Finder

@woodcock 

 

Would this be the same if I'm using either a dropdown vs. multi-select input?

I used the following for the multi-select case

 

where 'Arguments.category{}' IN $TestSuite$

 

 

I was then using  the following when I was using the dropdown. 

 

where 'Arguments.category{}' = "xxx"

 

 

 

However my issue is what's interpreted when I'm using either input types.

When I use this search string

 

"Arguments.category{}"= "$TestSuite$"

 

 

The output returns this search (with the parenthesis)

 

"Arguments.category{}"= "(backend/abc)"

 

 

I  am interested in getting this (without the parenthesis). 

 

"Arguments.category{}"= "backend/abc"

 

 

I'm curious if there's something I'm missing (or doing wrong) when I'm setting up the input UIs.   

0 Karma

woodcock
Esteemed Legend

(redacted)  You posted "dropdown", not "multiselect".  (redacted)

0 Karma

GaryZ
Path Finder

@woodcock 

Ideally I want multi-select.  I do understand the syntax in the dropdown.  however, the issue I'm having is the interpretation I'm getting in the search string when I'm using either of the case - dropdown or multi-select. 

 

Sorry for these newby questions.  I'm fairly new to Splunk, and have a lot to learn.  Thank you for being patient.

0 Karma

woodcock
Esteemed Legend

This is the stuff you need:
<label>TestSuite</label>
<prefix>Arguments.category{} IN(</prefix>
<suffix>)</suffix>
<valuePrefix>"</valuePrefix>
<valueSuffix>"</valueSuffix>
<delimiter>,</delimiter>

Then just use "| search $TestSuite$"

0 Karma

GaryZ
Path Finder

hello @yeahnah 

This is the code (redacted) that generated the input.  Please let me know if you any more information.  Thanks.

 

 

<input type="dropdown" token="TestSuite" searchWhenChanged="true">
      <label>TestSuite</label>
      <default>backend/abc</default>
      <initialValue>backend/abc</initialValue>
      <fieldForLabel>test_suite</fieldForLabel>
      <fieldForValue>test_suite</fieldForValue>
      <search>
        <query>index=service_index 
| rename "Arguments.category{}" as test_suite
| stats count by test_suite
| fields test_suite</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
      <prefix>"</prefix>
      <suffix>"</suffix>
    </input>

 

 

This is the code that's using the input from $TestSuite$

 

  <row>
    <panel>
      <chart>
        <title>Test Status (24Hrs)</title>
        <search>
          <query>index=service_index 
| where "Arguments.category{}" IN $TestSuite$
| stats count by Status</query>
          <earliest>$timeRange.earliest$</earliest>
          <latest>$timeRange.latest$</latest>
        </search>
        <option name="charting.chart">pie</option>
        <option name="charting.drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </chart>
    </panel>
  </row>

 

 

 

0 Karma

yeahnah
Motivator

Hi @GaryZ 

It would be easier to check if you provide the dashboard source XML, in case there is something strange going on there.  Please post the source XML inside a code sample block.

yeahnah_0-1681773168109.png

 

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...