I'm trying to build a dashboard element that will take input from a dropdown field and perform a search based on the item selected from the dashboard. No matter what I try, the search doesn't seem to take to the dropdown selection. I'm not writing this in XML, I'm just trying to use the dashboard wizard to build the panel. Nonetheless, here's what the XML looks like:
<fieldset submitButton="false">
<input type="dropdown" token="appName" searchWhenChanged="true">
<label>App Name</label>
<search>
<query>| DBQUERY ... | SEARCH DisplayName = $appName$ ...</query>
<earliest>@d</earliest>
<latest>now</latest>
</search>
<fieldForLabel>Label</fieldForLabel>
<fieldForValue>Value</fieldForValue>
<choice value="App Name">App Name</choice>
<default>App Name</default>
</input>
</fieldset>
I've also tried wrapping my token in quotes like below based on another Splunk question that I came across, but it didn't seem to make a difference:
<query>| DBQUERY ... | SEARCH DisplayName = "$appName$" ...</query
Thank you in advance for your help.
... View more