Splunk Search

How to give space in dashboard query?


Have drop down vaules like below

Extual vaul

Index =abc source = abc source 

 Drop down values like prod  lable 

Value source =abc source 

In query getting like error index=abc source=abc source  i required logic for space between index and source 



Labels (1)
0 Karma



have you try "|s$" with your token? See Token filters

r. Ismo

0 Karma


<input type= drop-down token =field1>

<Lable > Env</Lable>

< Choice value="_nontest " source="testing source"> TEST</choice>

<Choice value="  source="prodsource" >Prod</choice>



My query is like index=abc$field1$  | stats count  


which testing working fine when I select prod not getting any our and query also i below 

Index=abcsource="prodsource" | stats count 

How to give space between index and source while selecting prod .




0 Karma


Please use </> block when you are pasting code etc. to aswer/question. Then it don't change/drop any characters!

This should work with next options.

  <input type="dropdown" token="field1">
    <choice value='_nontest source="testing source"'> TEST</choice>
    <choice value=' source="prodsource"'>Prod</choice>
   index=abc $field1$ | stats count

Another way is replace those choise rows like

      <choice value="_nontest source=&quot;testing source&quot;">TEST</choice>
      <choice value="source=&quot;prodsource&quot;">Prod</choice>

 Those bot should work for you.

0 Karma
Get Updates on the Splunk Community!

Streamline Data Ingestion With Deployment Server Essentials

REGISTER NOW!Every day the list of sources Admins are responsible for gets bigger and bigger, often making the ...

Remediate Threats Faster and Simplify Investigations With Splunk Enterprise Security ...

REGISTER NOW!Join us for a Tech Talk around our latest release of Splunk Enterprise Security 7.2! We’ll walk ...

Introduction to Splunk AI

WATCH NOWHow are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. ...