Splunk Search

How to give space in dashboard query?

Sekhar
Explorer

Have drop down vaules like below

Extual vaul

Index =abc source = abc source 

 Drop down values like prod  lable 

Value source =abc source 

In query getting like error index=abc source=abc source  i required logic for space between index and source 

 

 

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

have you try "|s$" with your token? See Token filters

r. Ismo

0 Karma

Sekhar
Explorer

<input type= drop-down token =field1>

<Lable > Env</Lable>

< Choice value="_nontest " source="testing source"> TEST</choice>

<Choice value="  source="prodsource" >Prod</choice>

</Input> 

 

My query is like index=abc$field1$  | stats count  

 

which testing working fine when I select prod not getting any our and query also i below 

Index=abcsource="prodsource" | stats count 

How to give space between index and source while selecting prod .

 

 

 

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Please use </> block when you are pasting code etc. to aswer/question. Then it don't change/drop any characters!

This should work with next options.

<fieldset>
  <input type="dropdown" token="field1">
    <label>Env</label>
    <choice value='_nontest source="testing source"'> TEST</choice>
    <choice value=' source="prodsource"'>Prod</choice>
  </input>
</fieldset>
....
<query>
   index=abc $field1$ | stats count
</query>

Another way is replace those choise rows like

      <choice value="_nontest source=&quot;testing source&quot;">TEST</choice>
      <choice value="source=&quot;prodsource&quot;">Prod</choice>

 Those bot should work for you.

0 Karma
Get Updates on the Splunk Community!

What the End of Support for Splunk Add-on Builder Means for You

Hello Splunk Community! We want to share an important update regarding the future of the Splunk Add-on Builder ...

Solve, Learn, Repeat: New Puzzle Channel Now Live

Welcome to the Splunk Puzzle PlaygroundIf you are anything like me, you love to solve problems, and what ...

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...