Splunk Search

Dropdown input panel: Search is not changing as per dropdown selection

rashi83
Path Finder

So I created a dropdown input panel for weekwise but my search is not changing as per dropdown selection -

...

weekEnding
All
weekEnding
weekEnding

<query>index=db_compliance_audit| top limit=20 weekEnding</query>
<earliest>0</earliest>
<latest></latest>





<panel>
  <title>Host Summary Dashboard</title>
  <table>
    <search>
      <query>index=db_compliance_audit weekEnding = $weekEnding$ | xyseries hostname compName status</query>
      <earliest>0</earliest>
      <latest></latest>
    </search>
    <option name="count">10</option>
    <option name="drilldown">row</option>
    <option name="percentagesRow">false</option>
    <option name="refresh.display">progressbar</option>
    <option name="totalsRow">false</option>
    <format type="color" field="Failed">
      <colorPalette type="list">[#DC4E41]</colorPalette>
      <scale type="threshold"></scale>
    </format>
    <format type="color" field="Passed">
      <colorPalette type="list">[#53A051,#DC4E41]</colorPalette>
      <scale type="threshold">100</scale>
    </format>
    <format type="number" field="Passed"></format>
    <format type="number" field="percentage"></format>
    <format type="color" field="percentage">
      <colorPalette type="minMidMax" maxColor="#53A051" minColor="#DC4E41"></colorPalette>
      <scale type="minMidMax"></scale>
    </format>
    <drilldown>
      <set token="field1">$row.field1$</set>
      <set token="form.field1">$row.field1$</set>
    </drilldown>
  </table>......
1 Solution

niketn
Legend

@rashi83 while posting code/data use the code button (101010 or Ctrl+K) on Splunk Answer so that special characters do not escape. You dropdown code needs to be posted again as is missing in your current question.

In order to enforce token as String have you tried any of the following in the Splunk search query?

weekEnding = $weekEnding|s$

Or

weekEnding = "$weekEnding$"

In order to debug SPL with tokens you can also create HTML panel with SPL and run the search after tokens are resolved in a new Search window to confirm the expected behavior.

<row>
    <panel>
        <html>
            <div>index=db_compliance_audit weekEnding = $weekEnding|s$ | xyseries hostname compName status</div>
        </html>
    </panel>
</row>

PS: Is your use case really to run all time search?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn
Legend

@rashi83 while posting code/data use the code button (101010 or Ctrl+K) on Splunk Answer so that special characters do not escape. You dropdown code needs to be posted again as is missing in your current question.

In order to enforce token as String have you tried any of the following in the Splunk search query?

weekEnding = $weekEnding|s$

Or

weekEnding = "$weekEnding$"

In order to debug SPL with tokens you can also create HTML panel with SPL and run the search after tokens are resolved in a new Search window to confirm the expected behavior.

<row>
    <panel>
        <html>
            <div>index=db_compliance_audit weekEnding = $weekEnding|s$ | xyseries hostname compName status</div>
        </html>
    </panel>
</row>

PS: Is your use case really to run all time search?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

rashi83
Path Finder

Thanks, my code had worked. Matter of closing the currnet session and opening a new one.

0 Karma

niketn
Legend

@rashi83, do accept the answer to mark this question as answered!

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

Vijeta
Influencer

@rashi83 Did you try using quotes. weekEnding = "$weekEnding$". Also where and how are you setting the token for weekEnding.

0 Karma

rashi83
Path Finder

If I use quotes $weekending$ then entire dropdown disappears. TOken calue is set as field1 in the above xml

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...