I have the following search string in my chart panel.
"Arguments.category{}"= "$TestSuite$"
TestSuite is defined by the following dropdown UI-Input.
| stats count by test_suite
| fields test_suite
My question is when I use this string
"Arguments.category{}"= "$TestSuite$"
The output returns this search
"Arguments.category{}"= "(backend/resource_ql)"
I am interested in getting this (without the parenthesis).
"Arguments.category{}"= "backend/resource_ql"
What am I doing wrong? Thanks in advance.
You are using the wrong syntax in your "where". IMHO it should be:
| search Arguments.category() = "$TestSuite$"
| makeresults
| eval "Arguments.category{}" = "xxx"
| rename * AS *{}
| search "Arguments.category{}" = "xxx"
| search Arguments.category{} = "xxx"
| where 'Arguments.category{}' = "xxx"
TestSuite
Would this be the same if I'm using either a dropdown vs. multi-select input?
I used the following for the multi-select case
where 'Arguments.category{}' IN $TestSuite$
I was then using the following when I was using the dropdown.
where 'Arguments.category{}' = "xxx"
However my issue is what's interpreted when I'm using either input types.
When I use this search string
"Arguments.category{}"= "$TestSuite$"
The output returns this search (with the parenthesis)
"Arguments.category{}"= "(backend/abc)"
I am interested in getting this (without the parenthesis).
"Arguments.category{}"= "backend/abc"
I'm curious if there's something I'm missing (or doing wrong) when I'm setting up the input UIs.
(redacted) You posted "dropdown", not "multiselect". (redacted)
Ideally I want multi-select. I do understand the syntax in the dropdown. however, the issue I'm having is the interpretation I'm getting in the search string when I'm using either of the case - dropdown or multi-select.
Sorry for these newby questions. I'm fairly new to Splunk, and have a lot to learn. Thank you for being patient.
This is the stuff you need:
<label>TestSuite</label>
<prefix>Arguments.category{} IN(</prefix>
<suffix>)</suffix>
<valuePrefix>"</valuePrefix>
<valueSuffix>"</valueSuffix>
<delimiter>,</delimiter>
Then just use "| search $TestSuite$"
hello @yeahnah
This is the code (redacted) that generated the input. Please let me know if you any more information. Thanks.
<input type="dropdown" token="TestSuite" searchWhenChanged="true">
<label>TestSuite</label>
<default>backend/abc</default>
<initialValue>backend/abc</initialValue>
<fieldForLabel>test_suite</fieldForLabel>
<fieldForValue>test_suite</fieldForValue>
<search>
<query>index=service_index
| rename "Arguments.category{}" as test_suite
| stats count by test_suite
| fields test_suite</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<prefix>"</prefix>
<suffix>"</suffix>
</input>
This is the code that's using the input from $TestSuite$
<row>
<panel>
<chart>
<title>Test Status (24Hrs)</title>
<search>
<query>index=service_index
| where "Arguments.category{}" IN $TestSuite$
| stats count by Status</query>
<earliest>$timeRange.earliest$</earliest>
<latest>$timeRange.latest$</latest>
</search>
<option name="charting.chart">pie</option>
<option name="charting.drilldown">none</option>
<option name="refresh.display">progressbar</option>
</chart>
</panel>
</row>
Hi @GaryZ
It would be easier to check if you provide the dashboard source XML, in case there is something strange going on there. Please post the source XML inside a code sample block.