<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: how do you pass square brackets in form inputs? in Dashboards &amp; Visualizations</title>
    <link>https://community.splunk.com/t5/Dashboards-Visualizations/how-do-you-pass-square-brackets-in-form-inputs/m-p/194082#M12123</link>
    <description>&lt;P&gt;OK, well you have it now!&lt;/P&gt;</description>
    <pubDate>Thu, 27 Aug 2015 17:48:27 GMT</pubDate>
    <dc:creator>woodcock</dc:creator>
    <dc:date>2015-08-27T17:48:27Z</dc:date>
    <item>
      <title>how do you pass square brackets in form inputs?</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/how-do-you-pass-square-brackets-in-form-inputs/m-p/194075#M12116</link>
      <description>&lt;P&gt;I have a field that contains square brackets, and I can't get my dashboard to search on it properly when it's used in an input token. It keeps telling me no results are found. The search works fine from the search bar, and the token value is being populated as I would expect in the URL (with the brackets encoded of course), so I'm guessing something is funny with the token interpolation. Is there some special way I need to handle brackets? I've tried escaping them with the backslash (multiple times), using their HTML encoding value, trying to escape with quotes...no luck.&lt;/P&gt;

&lt;P&gt;Example: &lt;BR /&gt;
&amp;lt;pre&amp;gt;&amp;lt;choice value="foo[bar]"&amp;gt;Foo Bar&amp;lt;/choice&amp;gt;&amp;lt;/pre&amp;gt;&lt;/P&gt;</description>
      <pubDate>Wed, 26 Aug 2015 15:16:41 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/how-do-you-pass-square-brackets-in-form-inputs/m-p/194075#M12116</guid>
      <dc:creator>cphair</dc:creator>
      <dc:date>2015-08-26T15:16:41Z</dc:date>
    </item>
    <item>
      <title>Re: how do you pass square brackets in form inputs?</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/how-do-you-pass-square-brackets-in-form-inputs/m-p/194076#M12117</link>
      <description>&lt;P&gt;Did you try using double-quotes around the token name in your search string like this:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;index=blah myField="$fooBarToken$"
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Wed, 26 Aug 2015 19:15:20 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/how-do-you-pass-square-brackets-in-form-inputs/m-p/194076#M12117</guid>
      <dc:creator>woodcock</dc:creator>
      <dc:date>2015-08-26T19:15:20Z</dc:date>
    </item>
    <item>
      <title>Re: how do you pass square brackets in form inputs?</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/how-do-you-pass-square-brackets-in-form-inputs/m-p/194077#M12118</link>
      <description>&lt;P&gt;Yes, it is already enclosed in quotes. I've had to do that for tokens with special characters before, but the brackets seem to be really confusing something.&lt;/P&gt;</description>
      <pubDate>Thu, 27 Aug 2015 12:22:48 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/how-do-you-pass-square-brackets-in-form-inputs/m-p/194077#M12118</guid>
      <dc:creator>cphair</dc:creator>
      <dc:date>2015-08-27T12:22:48Z</dc:date>
    </item>
    <item>
      <title>Re: how do you pass square brackets in form inputs?</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/how-do-you-pass-square-brackets-in-form-inputs/m-p/194078#M12119</link>
      <description>&lt;P&gt;Did you try single-quotes?&lt;/P&gt;</description>
      <pubDate>Thu, 27 Aug 2015 13:01:47 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/how-do-you-pass-square-brackets-in-form-inputs/m-p/194078#M12119</guid>
      <dc:creator>woodcock</dc:creator>
      <dc:date>2015-08-27T13:01:47Z</dc:date>
    </item>
    <item>
      <title>Re: how do you pass square brackets in form inputs?</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/how-do-you-pass-square-brackets-in-form-inputs/m-p/194079#M12120</link>
      <description>&lt;P&gt;Yes--no luck.&lt;/P&gt;</description>
      <pubDate>Thu, 27 Aug 2015 13:13:31 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/how-do-you-pass-square-brackets-in-form-inputs/m-p/194079#M12120</guid>
      <dc:creator>cphair</dc:creator>
      <dc:date>2015-08-27T13:13:31Z</dc:date>
    </item>
    <item>
      <title>Re: how do you pass square brackets in form inputs?</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/how-do-you-pass-square-brackets-in-form-inputs/m-p/194080#M12121</link>
      <description>&lt;P&gt;OK, let's go hardcore and try thiese:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;index=blah | where match(myField, "^$fooBarToken$$")
index=blah | where match(myField, "$fooBarToken$")
index=blah | where like(myField, "$fooBarToken$")
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;Also try swapping double-quotes for single-quotes.  One of these should work.&lt;/P&gt;</description>
      <pubDate>Thu, 27 Aug 2015 13:47:34 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/how-do-you-pass-square-brackets-in-form-inputs/m-p/194080#M12121</guid>
      <dc:creator>woodcock</dc:creator>
      <dc:date>2015-08-27T13:47:34Z</dc:date>
    </item>
    <item>
      <title>Re: how do you pass square brackets in form inputs?</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/how-do-you-pass-square-brackets-in-form-inputs/m-p/194081#M12122</link>
      <description>&lt;P&gt;Ugh, it ended up being an error earlier in the search--nothing to do with the brackets. Printing out the field values like you suggested below showed it up. Thanks for your help.&lt;/P&gt;</description>
      <pubDate>Thu, 27 Aug 2015 17:22:26 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/how-do-you-pass-square-brackets-in-form-inputs/m-p/194081#M12122</guid>
      <dc:creator>cphair</dc:creator>
      <dc:date>2015-08-27T17:22:26Z</dc:date>
    </item>
    <item>
      <title>Re: how do you pass square brackets in form inputs?</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/how-do-you-pass-square-brackets-in-form-inputs/m-p/194082#M12123</link>
      <description>&lt;P&gt;OK, well you have it now!&lt;/P&gt;</description>
      <pubDate>Thu, 27 Aug 2015 17:48:27 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/how-do-you-pass-square-brackets-in-form-inputs/m-p/194082#M12123</guid>
      <dc:creator>woodcock</dc:creator>
      <dc:date>2015-08-27T17:48:27Z</dc:date>
    </item>
  </channel>
</rss>

