Trying to extract a string from a delimited token value in a dashboard to be used in a field search

[beetlegeuse]

I have a dropdown input type in a dashboard that has a token aligned with it (we'll call it $dropdown_value$); the values in the dropdown look similar to this:

This is a value 1234 (ABC):abcd

I'm trying to extract the string after the colon (abcd) for use in a query; this is the query I'm testing, but it's not working ("No results found" returned in the query's dashboard panel):

index=summary environment=prod report=blah 
| eval my_rex_field="$dropdown_value$" 
| rex field=my_rex_field "[A-Za-z0-9\s\(\)]+\:(?<agentroot>[A-Za-z0-9\W]+)" 
| search AgentName=agentroot

Any ideas regarding where I may be going astray? The token value looks correct as I have it included in the panel title, and the rex works as expected in regex101. I've also tried using split/mvindex to no avail.

[ITWhisperer · Accepted solution]

Try

| where AgentName=agentroot

If this doesn't work, please be more expansive about what works and what doesn't work

Also, why not use abcd as the value for the dropdown and the full string as the label?

[beetlegeuse]

Using the "where" command did not work; after reading your question, though, I took another look at how my dropdown input stanza was defined.

I'm using a query to auto-populate the input; by default, the results are used for both the label and the value. After adding the fieldForLabel and fieldForValue tags and adjusting the stats command in the query to reference the correct fields for each of those tags (AgentName for fieldForValue and another field for fieldForLabel), I now have the dropdown looking exactly how I want it without the need for splitting out the token value.

Thank you!