All Apps and Add-ons

How to convert the stats field to string?

jieli
New Member

I used a column of the stats table as a dropdown list, so the dropdown token represents a selected cell. But when I try to do a search using the token variable $tokenname$, it's not a string so I couldn't use it to map with where clause.
Here is the field I want to compare:

mvexpand metrics | spath input=metrics | rename "code" as code

Code is a string jsonfield.

The `where code=$tokenname$ does not work because the token is not a string.

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The |s token suffix will put the token value within quotation marks. For example, where code=$tokenname|s$.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The |s token suffix will put the token value within quotation marks. For example, where code=$tokenname|s$.

---
If this reply helps you, Karma would be appreciated.
0 Karma

atammana_splunk
Splunk Employee
Splunk Employee

Hey @richgalloway - were you able to achieve your desired solution with this?

0 Karma

jieli
New Member

It worked, thanks.
But the subquery does not automatically run when I select another token value from the dropdown. What am I missing?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Can you share the relevant dashboard code?

---
If this reply helps you, Karma would be appreciated.
0 Karma

jieli
New Member

I added a submit button to manually trigger the update.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

You should ask the OP.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...