Splunk Search

Not Reading Dropdown Form Tokens

willial
Communicator

I'm trying to use two dropdowns, one to select a fiscal quarter and one to select the fiscal year. These are both based off of choices rather than search-populated, as so:

    <fieldset>
  <input type="dropdown" token="qDropMo" searchWhenChanged="true">
      <label>Select Fiscal Quarter</label>
      <choice value="Q1">Q1</choice>
      <choice value="Q2">Q2</choice>
      <choice value="Q3">Q3</choice>
      <choice value="Q4">Q4</choice>
      <default>Q1</default>
  </input>
  <input type="dropdown" token="qDropYr" searchWhenChanged="true">
      <label>Select Fiscal Year</label>
      <choice value="2013">2013</choice>
      <choice value="2014">2014</choice>
      <choice value="2015">2015</choice>
      <default>2015</default>
  </input>
  </fieldset>

The problem I'm having comes from trying to use these. The URL happily contains:

?form.qDropMo=Q1&form.qDropYr=2015

but a simple eval statement such as:

| eval quarterStartMo=if($form.qDropMo$="Q1",7,quarterStartMo)

returns nothing. Even something like:

| eval quarter = $form.qDropMo$

returns nothing. I'm very confused as to why I can't pull the form information into my search.

0 Karma

willial
Communicator

I've found the culprit. I have a |stats (etc) line in the full search that is somehow interfering. If I remove the |stats line this works normally. I have no idea why.

somesoni2
Revered Legend

Can you post the full query, in case removing that stats part affects your need. Just ignore this if you're fine without it.

0 Karma

somesoni2
Revered Legend

The dropdown values are string and they need to be enclosed within double quotes while using them.

So change the searches like this.

| eval quarterStartMo=if("$form.qDropMo$"="Q1",7,quarterStartMo)

and 

| eval quarter = "$form.qDropMo$"

Update

See this runanywhere sample with your example dropdowns and it works for me.

<form>
   <label>Token Issue</label>
  <fieldset>
    <input type="dropdown" token="qDropMo" searchWhenChanged="true">
      <label>Select Fiscal Quarter</label>
      <choice value="Q1">Q1</choice>
      <choice value="Q2">Q2</choice>
      <choice value="Q3">Q3</choice>
      <choice value="Q4">Q4</choice>
      <default>Q1</default>
    </input>
    <input type="dropdown" token="qDropYr" searchWhenChanged="true">
      <label>Select Fiscal Year</label>
      <choice value="2013">2013</choice>
      <choice value="2014">2014</choice>
      <choice value="2015">2015</choice>
      <default>2015</default>
    </input>
  </fieldset>
  <row>
     <table>
      <title>SampleData</title>
      <searchString>| stats count as quarterStartMo | eval quarterStartMo=if("$form.qDropMo$"="Q1",7,quarterStartMo)
| eval quarter = "$form.qDropMo$"</searchString>
      <earliestTime>-15m@m</earliestTime>
      <latestTime>now</latestTime>
      <option name="count">5</option>     
    </table>
  </row>
</form>
0 Karma

willial
Communicator

I've tried with and without the double quotes. It doesn't seem to make a difference here.

0 Karma
Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  &#x1f680; Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...