topic Re: How can I escape double quotes in a token to modify a search? in Dashboards & Visualizations

How can I escape double quotes in a token to modify a search?

johnraftery — Tue, 12 Jan 2016 15:05:03 GMT

I have a search which sometimes I want to do an append, and sometimes not - this should be driven by a checkbox in the GUI. The optional append looks like this:

| append [ search eventtype=x sourcetype=y host=z | eval series=if(like(source, "%vmstat_DB_%"), "CPU DB", source), | rename cpu_used as value | table _time series value ]

I have defined a checkbox like this:

< input type="checkbox" token="CPU_IN_TPS" searchWhenChanged="true">
        < choice value="
| append [ search eventtype=x sourcetype=y host=z | eval series=if(like(source, "%vmstat_DB_%"), "CPU DB", source), | rename cpu_used as value | table _time series value ]">ON< /choice>
      < /input>

And $CPU_IN_TPS$ goes at the end of my main search.

My problem is that double quotes are not accepted inside a token value. Is there a way of escaping them? Should I be using a macro instead?

Many thanks,
John Raftery

Re: How can I escape double quotes in a token to modify a search?

renjith_nair — Tue, 12 Jan 2016 15:14:09 GMT

In XML you can use " instead of ". It's working for me

<choice value="&quot; | append [ search eventtype=x sourcetype=y host=z | eval series=if(like(source, &quot;%vmstat_DB_%&quot;), &quot;CPU DB&quot;, source), | rename cpu_used as value | table _time series value ]&quot;">ON</choice>

Re: How can I escape double quotes in a token to modify a search?

johnraftery — Tue, 29 Sep 2020 08:24:51 GMT

This solved the quote issue - thanks very much. Strangely, the commas seem to disappear in the search - I end up with
eval series=if(like(source "%vmstat_DB_%") "CPU DB" source
Did you have this as well?

Re: How can I escape double quotes in a token to modify a search?

renjith_nair — Tue, 12 Jan 2016 16:22:17 GMT

not really. Below dashboard works perfect

<form>
  <label>TEST</label>
  <fieldset submitButton="false">
    <input type="checkbox" token="field1" searchWhenChanged="true">
      <choice value="| append [ |stats count| eval series=if(like(count, &quot;%vmstat_DB_%&quot;), &quot;CPU DB&quot;, count) | rename cpu_used as value | table _time series value ]">Test</choice>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>Test $field1$</title>
      <table>
        <search>
          <query>|stats count|eval count=100 $field1$</query>
          <earliest>0</earliest>
        </search>
      </table>
    </panel>
  </row>
</form>

Re: How can I escape double quotes in a token to modify a search?

johnraftery — Tue, 12 Jan 2016 16:32:23 GMT

I get an error when trying to use the fieldset node:
XML Syntax Error: Row, on line=320, contains unknown node=fieldset on line=321.

What does this node do?

Re: How can I escape double quotes in a token to modify a search?

johnraftery — Tue, 12 Jan 2016 16:39:44 GMT

Never mind - I had the checkbox set up wrong. Thanks for your help!

Re: How can I escape double quotes in a token to modify a search?

kgtardiff — Tue, 29 Sep 2020 12:35:35 GMT

For the panel requiring the double quotes to be escaped (\"), add:
|rex mode=sed field=FIELD_REQUIRING_ESCAPES "s/\"/"\\""/g"

It's using a Linux sed equivalent to replace every occurrence of " (\") with \" ("\\""). Different than Linux syntax, but it's working for me...

Re: How can I escape double quotes in a token to modify a search?

weidertc — Wed, 03 Jan 2024 14:14:57 GMT

You can use a token modifier |s to escape double quotes.

$token$

$token|s$

The value of the tokens get parsed

asdf="asdf"

"asdf=\"asdf\""

Unfortunately, this also adds double quotes around it, which makes this modifier useless in all my work. I would have preferred only having 1 effect per modifier that can stack with others for those that want both, but this might work for others.

The modifiers for tokens inside of alert action email bodies may not be available, but it will work in dashboards.

Source: https://docs.splunk.com/Documentation/Splunk/9.1.2/Viz/tokens#Syntax_to_consume_tokens