Splunk Search

How to give space in dashboard query?

Sekhar
Explorer

Have drop down vaules like below

Extual vaul

Index =abc source = abc source 

 Drop down values like prod  lable 

Value source =abc source 

In query getting like error index=abc source=abc source  i required logic for space between index and source 

 

 

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

have you try "|s$" with your token? See Token filters

r. Ismo

0 Karma

Sekhar
Explorer

<input type= drop-down token =field1>

<Lable > Env</Lable>

< Choice value="_nontest " source="testing source"> TEST</choice>

<Choice value="  source="prodsource" >Prod</choice>

</Input> 

 

My query is like index=abc$field1$  | stats count  

 

which testing working fine when I select prod not getting any our and query also i below 

Index=abcsource="prodsource" | stats count 

How to give space between index and source while selecting prod .

 

 

 

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Please use </> block when you are pasting code etc. to aswer/question. Then it don't change/drop any characters!

This should work with next options.

<fieldset>
  <input type="dropdown" token="field1">
    <label>Env</label>
    <choice value='_nontest source="testing source"'> TEST</choice>
    <choice value=' source="prodsource"'>Prod</choice>
  </input>
</fieldset>
....
<query>
   index=abc $field1$ | stats count
</query>

Another way is replace those choise rows like

      <choice value="_nontest source=&quot;testing source&quot;">TEST</choice>
      <choice value="source=&quot;prodsource&quot;">Prod</choice>

 Those bot should work for you.

0 Karma
Get Updates on the Splunk Community!

Good Sourcetype Naming

When it comes to getting data in, one of the earliest decisions made is what to use as a sourcetype. Often, ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Splunk App for Anomaly Detection End of Life Announcement

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...