topic Multivalues not working with Acronym in Dashboards & Visualizations

Multivalues not working with Acronym

splunksplunk232 — Sun, 06 Jan 2019 12:15:55 GMT

HI all,

I have a multi values filter based on a query from Database and the query return string with apostrophes(Acronym).
for example SQ"L.
In the drop-down values it displays the string until the quota which in this case is SQ.
How i configure the multi values to work with string that continues apostrophes.

Thank you in advance

Re: Multivalues not working with Acronym

richgalloway — Sun, 06 Jan 2019 14:39:10 GMT

Please share the query that builds the drop-down menu.

Re: Multivalues not working with Acronym

splunksplunk232 — Wed, 06 Feb 2019 08:18:46 GMT

The problem solved, apperently that when splunk displays information it finds info between two apostrophes.
so if the data looks like

 id=1 value="ab"c"

when the query will be

 index="some_index"
 | table id value

the table will be like

 1 ab

but the _raw will be noramal

 id=1 value="ab"c"

so i simply created a field extraction to get the value.