Dashboards & Visualizations

How to get a dashboard input token to handle values that contain spaces?

Zerophage
New Member

Hi all, new to Splunk.

I have a Dashboard Input with a token which is assigned a value which can be a string with spaces. For example it might be a subject of an email like "RE: How was work".

Now I have a search in the same dashboard which uses that token like message_subject=$search_subject$ but it returns nothing. I suspect it is due to the spaces in the value and i need to add quotes to the token.

Is there an easy way to do this?

Thanks!

Tags (3)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi Zerophage,
if spaces are the problem, try using brackets:

message_subject="$search_subject$"

Bye.
Giuseppe

View solution in original post

Zerophage
New Member

Thanks! Why did I not think of that, was trying all sorts other than the most obvious haha.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi Zerophage,
if spaces are the problem, try using brackets:

message_subject="$search_subject$"

Bye.
Giuseppe

Get Updates on the Splunk Community!

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...

.conf24 | Personalize your .conf experience with Learning Paths!

Personalize your .conf24 Experience Learning paths allow you to level up your skill sets and dive deeper ...

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...