Splunk Search

How to give space in dashboard query?

Sekhar
Explorer

Have drop down vaules like below

Extual vaul

Index =abc source = abc source 

 Drop down values like prod  lable 

Value source =abc source 

In query getting like error index=abc source=abc source  i required logic for space between index and source 

 

 

Labels (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

have you try "|s$" with your token? See Token filters

r. Ismo

0 Karma

Sekhar
Explorer

<input type= drop-down token =field1>

<Lable > Env</Lable>

< Choice value="_nontest " source="testing source"> TEST</choice>

<Choice value="  source="prodsource" >Prod</choice>

</Input> 

 

My query is like index=abc$field1$  | stats count  

 

which testing working fine when I select prod not getting any our and query also i below 

Index=abcsource="prodsource" | stats count 

How to give space between index and source while selecting prod .

 

 

 

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Please use </> block when you are pasting code etc. to aswer/question. Then it don't change/drop any characters!

This should work with next options.

<fieldset>
  <input type="dropdown" token="field1">
    <label>Env</label>
    <choice value='_nontest source="testing source"'> TEST</choice>
    <choice value=' source="prodsource"'>Prod</choice>
  </input>
</fieldset>
....
<query>
   index=abc $field1$ | stats count
</query>

Another way is replace those choise rows like

      <choice value="_nontest source=&quot;testing source&quot;">TEST</choice>
      <choice value="source=&quot;prodsource&quot;">Prod</choice>

 Those bot should work for you.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...