Splunk Search

Not Reading Dropdown Form Tokens

willial
Communicator

I'm trying to use two dropdowns, one to select a fiscal quarter and one to select the fiscal year. These are both based off of choices rather than search-populated, as so:

    <fieldset>
  <input type="dropdown" token="qDropMo" searchWhenChanged="true">
      <label>Select Fiscal Quarter</label>
      <choice value="Q1">Q1</choice>
      <choice value="Q2">Q2</choice>
      <choice value="Q3">Q3</choice>
      <choice value="Q4">Q4</choice>
      <default>Q1</default>
  </input>
  <input type="dropdown" token="qDropYr" searchWhenChanged="true">
      <label>Select Fiscal Year</label>
      <choice value="2013">2013</choice>
      <choice value="2014">2014</choice>
      <choice value="2015">2015</choice>
      <default>2015</default>
  </input>
  </fieldset>

The problem I'm having comes from trying to use these. The URL happily contains:

?form.qDropMo=Q1&form.qDropYr=2015

but a simple eval statement such as:

| eval quarterStartMo=if($form.qDropMo$="Q1",7,quarterStartMo)

returns nothing. Even something like:

| eval quarter = $form.qDropMo$

returns nothing. I'm very confused as to why I can't pull the form information into my search.

0 Karma

willial
Communicator

I've found the culprit. I have a |stats (etc) line in the full search that is somehow interfering. If I remove the |stats line this works normally. I have no idea why.

somesoni2
SplunkTrust
SplunkTrust

Can you post the full query, in case removing that stats part affects your need. Just ignore this if you're fine without it.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

The dropdown values are string and they need to be enclosed within double quotes while using them.

So change the searches like this.

| eval quarterStartMo=if("$form.qDropMo$"="Q1",7,quarterStartMo)

and 

| eval quarter = "$form.qDropMo$"

Update

See this runanywhere sample with your example dropdowns and it works for me.

<form>
   <label>Token Issue</label>
  <fieldset>
    <input type="dropdown" token="qDropMo" searchWhenChanged="true">
      <label>Select Fiscal Quarter</label>
      <choice value="Q1">Q1</choice>
      <choice value="Q2">Q2</choice>
      <choice value="Q3">Q3</choice>
      <choice value="Q4">Q4</choice>
      <default>Q1</default>
    </input>
    <input type="dropdown" token="qDropYr" searchWhenChanged="true">
      <label>Select Fiscal Year</label>
      <choice value="2013">2013</choice>
      <choice value="2014">2014</choice>
      <choice value="2015">2015</choice>
      <default>2015</default>
    </input>
  </fieldset>
  <row>
     <table>
      <title>SampleData</title>
      <searchString>| stats count as quarterStartMo | eval quarterStartMo=if("$form.qDropMo$"="Q1",7,quarterStartMo)
| eval quarter = "$form.qDropMo$"</searchString>
      <earliestTime>-15m@m</earliestTime>
      <latestTime>now</latestTime>
      <option name="count">5</option>     
    </table>
  </row>
</form>
0 Karma

willial
Communicator

I've tried with and without the double quotes. It doesn't seem to make a difference here.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...