Why aren't space characters saved on my dashboard?

[jeffland]

Hey,
I have a problem which has kind of been mentioned before, but wasn't sufficiently answered. For example, imagine I want to do multiple lookups in one search, using a multiselect to allow the user to choose which lookups to use. The code for the dashboard looks like this:

<input type="multiselect" token="lookup_tok" searchWhenChanged="true">
  <label>Geofences</label>
  <choice value="lookup_a">A</choice>
  <choice value="lookup_b">B</choice>
  <default>A</default>
  <valuePrefix>| lookup </valuePrefix>
  <valueSuffix> inputfield inputfield2 OUTPUTNEW field2</valueSuffix>
  <delimiter> </delimiter>
</input>
...
<search>
  <query>source=geo $lookup_tok$ | table ...</query>

The problem is with "valuePrefix" and "valueSuffix". There is a space character at the end of the prefix and the beginning of the suffix. These are obligatory, obviously - if they weren't present, the compiled token would look like

| lookuplookup_ainputfield...

Problem is, Splunk doesn't save that space character using the integrated UI-Editor, only when saving the Simple XML text directly containing a space. If I try to save those values from the UI in the dialog to edit an input, they simply aren't saved; what's worse is that if I add them in Simple XML (which results in the desired behavior) and then use the UI editor to change anything on the dashboard, they are removed (which breaks the dashboard). The problem is probably not the space character itself, I have tried using   instead with the exact same results.
The same happens if you try to add the space characters in the actual "value"-attribute of the choices like so:

<input type="multiselect" token="geofence_lookup_tok" searchWhenChanged="true">
  <label>Geofences</label>
  <choice value=" geo_a ">A</choice>
  <choice value=" geo_b ">B</choice>
  <default>A</default>
  <valuePrefix>| lookup</valuePrefix>
  <valueSuffix>latitude longitude OUTPUTNEW featureId</valueSuffix>
  <delimiter> </delimiter>
</input>

This also comes into play when you don't want the token to have an effect under certain conditions - e.g. when you have an input to select whether to filter something or not:

<input type="dropdown" token="filter_tok" searchWhenChanged="true">
  <label>Filter</label>
  <choice value="| where foo>0">Filter foo</choice>
  <choice value=" ">Don't filter foo</choice>
...
<search>
  <query>source=baz | stats foo $filter_tok$</query>

This behavior can also be observed when you explicitly set a token:

<change>
  <condition label="Filter">
    <set token="some_token">| where something</set>
  </condition>
  <condition label="No Filter">
    <set token="some_token"> </set>
  </condition>

All these space characters will disappear when using the UI to edit the dashboard. Any Ideas?

[spammenot66]

What I've found to work is to use in place of space for html tags or xml tags. Please accept as answer or award point if this works for you.

in the case of your token tag, change it to

<set token="some_token">&#32;</set>

[jeffland]

As I've already said in my question,   behaves just like space, so this doesn't work either.

[gcusello]

Hi jeffland,
use | lookup " as prefix and " inputfield inputfield2 OUTPUTNEW field2 as suffix.
Bye.
Giuseppe

[jeffland]

Cool, this actually does the trick for case 1 (you can put the name of the lookup in double quotes) - thanks for the suggestion!
It still doesn't fix the problems when setting a token explicitly or using a space character for an options value.

[gcusello]

try in the same way.
Bye.
Giuseppe

[jeffland]

That won't work, I can't just add double quotes randomly somewhere in my search. Or maybe I didn't get how you want to do it in the following situation:

<input type="dropdown" token="filter_tok" searchWhenChanged="true">
  <label>Filter</label>
  <choice value="| where foo>0">Filter foo</choice>
  <choice value=" ">Don't filter foo</choice>
  ...
<search>
  <query>source=baz | stats foo $filter_tok$</query>

[gcusello]

Hi jeffland,
Sorry, I didn't understand the second part of the problem!
There isn't a direct solution because it isn't possible to set a null value to a token, you could use a workaround (or better "a porkaround") inserting a condition always true like | where 1=1 or | search index=*.
Bye.
Giuseppe

[jeffland]

Yeah, I've also used | noop in the past, but it just doesn't feel right. I was looking for a proper solution, but maybe there is none (yet). Thanks for your input nonetheless!

[cmerriman]

try this: a space in the value and two spaces in the suffix before inputfield. it worked in a test dashboard.

  <input type="multiselect" token="lookup_tok" searchWhenChanged="true">
    <label>Geofences</label>
    <choice value=" lookup_a">A</choice>
    <choice value=" lookup_b">B</choice>
    <default>A</default>
    <valuePrefix>| lookup</valuePrefix>
    <valueSuffix>  inputfield inputfield2 OUTPUTNEW field2</valueSuffix>
    <delimiter> </delimiter>
  </input>

OR two spaces after the prefix and two spaces before the suffix

 <input type="multiselect" token="lookup_tok" searchWhenChanged="true">
    <label>Geofences</label>
    <choice value="lookup_a">A</choice>
    <choice value="lookup_b">B</choice>
    <default>A</default>
    <valuePrefix>| lookup  </valuePrefix>
    <valueSuffix>  inputfield inputfield2 OUTPUTNEW field2</valueSuffix>
    <delimiter> </delimiter>
  </input>

my output was | lookup lookup_a inputfield inputfield2 OUTPUTNEW field2

[jeffland]

Unfortunately, this results in the same behavior as a single space character. You'll notice that when you a) set those two spaces in Simple XML (you still can't set them in the UI) b) change something on the dashboard in the UI and c) re-open the dashboard.

[james_hopton]

We are having a similar issue. our spaces will save initially, but after some amount of time and/or editing, the spaces around certain characters are removed.

Most often modified example:
We use something similar to "|fields - Field1,Field2" in a dashboard query. Every so often the spaces are removed making the command not work. e.g. "|fields-Field1,Field2"

Would be glad to help troubleshoot if someone has steps.