Splunk Search

Not Reading Dropdown Form Tokens

willial
Communicator

I'm trying to use two dropdowns, one to select a fiscal quarter and one to select the fiscal year. These are both based off of choices rather than search-populated, as so:

    <fieldset>
  <input type="dropdown" token="qDropMo" searchWhenChanged="true">
      <label>Select Fiscal Quarter</label>
      <choice value="Q1">Q1</choice>
      <choice value="Q2">Q2</choice>
      <choice value="Q3">Q3</choice>
      <choice value="Q4">Q4</choice>
      <default>Q1</default>
  </input>
  <input type="dropdown" token="qDropYr" searchWhenChanged="true">
      <label>Select Fiscal Year</label>
      <choice value="2013">2013</choice>
      <choice value="2014">2014</choice>
      <choice value="2015">2015</choice>
      <default>2015</default>
  </input>
  </fieldset>

The problem I'm having comes from trying to use these. The URL happily contains:

?form.qDropMo=Q1&form.qDropYr=2015

but a simple eval statement such as:

| eval quarterStartMo=if($form.qDropMo$="Q1",7,quarterStartMo)

returns nothing. Even something like:

| eval quarter = $form.qDropMo$

returns nothing. I'm very confused as to why I can't pull the form information into my search.

0 Karma

willial
Communicator

I've found the culprit. I have a |stats (etc) line in the full search that is somehow interfering. If I remove the |stats line this works normally. I have no idea why.

somesoni2
Revered Legend

Can you post the full query, in case removing that stats part affects your need. Just ignore this if you're fine without it.

0 Karma

somesoni2
Revered Legend

The dropdown values are string and they need to be enclosed within double quotes while using them.

So change the searches like this.

| eval quarterStartMo=if("$form.qDropMo$"="Q1",7,quarterStartMo)

and 

| eval quarter = "$form.qDropMo$"

Update

See this runanywhere sample with your example dropdowns and it works for me.

<form>
   <label>Token Issue</label>
  <fieldset>
    <input type="dropdown" token="qDropMo" searchWhenChanged="true">
      <label>Select Fiscal Quarter</label>
      <choice value="Q1">Q1</choice>
      <choice value="Q2">Q2</choice>
      <choice value="Q3">Q3</choice>
      <choice value="Q4">Q4</choice>
      <default>Q1</default>
    </input>
    <input type="dropdown" token="qDropYr" searchWhenChanged="true">
      <label>Select Fiscal Year</label>
      <choice value="2013">2013</choice>
      <choice value="2014">2014</choice>
      <choice value="2015">2015</choice>
      <default>2015</default>
    </input>
  </fieldset>
  <row>
     <table>
      <title>SampleData</title>
      <searchString>| stats count as quarterStartMo | eval quarterStartMo=if("$form.qDropMo$"="Q1",7,quarterStartMo)
| eval quarter = "$form.qDropMo$"</searchString>
      <earliestTime>-15m@m</earliestTime>
      <latestTime>now</latestTime>
      <option name="count">5</option>     
    </table>
  </row>
</form>
0 Karma

willial
Communicator

I've tried with and without the double quotes. It doesn't seem to make a difference here.

0 Karma
Get Updates on the Splunk Community!

App Platform's 2025 Year in Review: A Year of Innovation, Growth, and Community

As we step into 2026, it’s the perfect moment to reflect on what an extraordinary year 2025 was for the Splunk ...

Operationalizing Entity Risk Score with Enterprise Security 8.3+

Overview Enterprise Security 8.3 introduces a powerful new feature called “Entity Risk Scoring” (ERS) for ...

Unlock Database Monitoring with Splunk Observability Cloud

  In today’s fast-paced digital landscape, even minor database slowdowns can disrupt user experiences and ...