topic Re: How to escape double quotes in a Dashboard? in Dashboards & Visualizations

How to escape double quotes in a Dashboard?

ma_anand1984 — Wed, 17 Jul 2013 06:54:26 GMT

In my dashboard, i display log messages in a table. There are logs which has double quotes. I use custom drilldown to goto search app.

Now when i click messages with double quotes, I get unbalanced quotes error. I can escape in search app with a slash and it works. But if i use eval - replace in my dashboard to add a slash, that slash is escaped automatically by splunk and i get \" instead of \".

I know i can remove double quotes in my dashboard to make it work, but im looking to escape the quotes in-order to show users accurate error messages

Re: How to escape double quotes in a Dashboard?

ma_anand1984 — Wed, 17 Jul 2013 07:16:38 GMT

note: im using SimpleResultsTable with
$click.fields.field_name$

Re: How to escape double quotes in a Dashboard?

chimbudp — Wed, 17 Jul 2013 07:31:32 GMT

have u tried extract field option?

Re: How to escape double quotes in a Dashboard?

chimbudp — Wed, 17 Jul 2013 07:32:10 GMT

create a proper REGEX for the items inside the "" and extract the value

Re: How to escape double quotes in a Dashboard?

Drainy — Wed, 17 Jul 2013 09:32:40 GMT

Could you post a couple of example events?

Re: How to escape double quotes in a Dashboard?

ma_anand1984 — Wed, 17 Jul 2013 12:07:37 GMT

@drainy

Non Function error : <?xml version="1.0" encoding="UTF-8"?><env:Envelope xmlns:env="http://schemas.x

im displaying this under field msg.Im passing this value in drilldown search as msg="$click.fields.msg$". Now my search is failing with "unbalanced quote" error

Re: How to escape double quotes in a Dashboard?

linu1988 — Wed, 17 Jul 2013 12:22:52 GMT

Use &quot instead of the quote in your search expression in xml

Re: How to escape double quotes in a Dashboard?

sideview — Wed, 17 Jul 2013 18:01:38 GMT

Splunk's SimpleResultsTable and JSChart/FlashChart modules don't have any mechanism to escape either backslashes or double-quotes automatically for drilldowns. So for those modules drilldowns on such tokens as C:\foo\bar\baz as well as this "has some doublequotes" in it will end up searching on the wrong thing or will fail with parse errors.

Sideview Utils, which you're using here (I can tell from $click.fields.msg$ as well as from knowing you from lots of previous questions/emails), does a lot of careful work and patches to provide a consistent $click.fields.fieldName$ key that is backslash-escaped, and a $click.fields.fieldName.rawValue$ key that is not. (in general for every Sideview key that might be destined for the search language, and that comes from user input or from a field value in search results, there will be a *.rawValue $foo$ token as well. the normal escaped key is for anything that goes directly into search language. The *.rawValue equivalent is what you should use for redirects, URL arguments, and to display HTML to the user.)

Unfortunately there's an oversight in the Sideview code. While it very carefully escapes backslash characters correctly in all of its testcases, escaping C:\foo\bar\baz correctly, it forgets that double-quote characters are equally problematic.

I can fix this fairly easily just by tracing through the code and since the set of testcases is pretty much already there, and I'll get it fixed in the next release.

Re: How to escape double quotes in a Dashboard?

ma_anand1984 — Thu, 18 Jul 2013 05:48:54 GMT

Thanks Nick, let me know when this is available. I am really surprised that nobody asked about this in splunk so far. I feel its such a basic requirement.

Re: How to escape double quotes in a Dashboard?

ma_anand1984 — Mon, 28 Sep 2020 14:22:41 GMT

For the sake of new splunkers,

I'm using Core Splunk module SimpleResultsTable. But with the addition of SV (Side View utils), i can access special fields like $click.fields.msg$. they are called $foo$ tokens

if you have SV installed go to
http:///en-US/app/sideview_utils/custom_keys
http:///en-US/app/sideview_utils/linking2_tables

for more information