Splunk Search

How to give space in dashboard query?

Sekhar
Explorer

Have drop down vaules like below

Extual vaul

Index =abc source = abc source 

 Drop down values like prod  lable 

Value source =abc source 

In query getting like error index=abc source=abc source  i required logic for space between index and source 

 

 

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

have you try "|s$" with your token? See Token filters

r. Ismo

0 Karma

Sekhar
Explorer

<input type= drop-down token =field1>

<Lable > Env</Lable>

< Choice value="_nontest " source="testing source"> TEST</choice>

<Choice value="  source="prodsource" >Prod</choice>

</Input> 

 

My query is like index=abc$field1$  | stats count  

 

which testing working fine when I select prod not getting any our and query also i below 

Index=abcsource="prodsource" | stats count 

How to give space between index and source while selecting prod .

 

 

 

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Please use </> block when you are pasting code etc. to aswer/question. Then it don't change/drop any characters!

This should work with next options.

<fieldset>
  <input type="dropdown" token="field1">
    <label>Env</label>
    <choice value='_nontest source="testing source"'> TEST</choice>
    <choice value=' source="prodsource"'>Prod</choice>
  </input>
</fieldset>
....
<query>
   index=abc $field1$ | stats count
</query>

Another way is replace those choise rows like

      <choice value="_nontest source=&quot;testing source&quot;">TEST</choice>
      <choice value="source=&quot;prodsource&quot;">Prod</choice>

 Those bot should work for you.

0 Karma
Get Updates on the Splunk Community!

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...

Splunk App Dev Community Updates – What’s New and What’s Next

Welcome to your go-to roundup of everything happening in the Splunk App Dev Community! Whether you're building ...

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco &#43; Splunk! We’ve ...