topic Re: How to save bracket syntax in a report in Splunk Search

How to save bracket syntax in a report

jip31 — Tue, 25 Jun 2019 05:14:54 GMT

Hi
In my XML file, I use the syntax below which works perfectly

   | search SITE=$tok_filtersite|s$

But I need to save it in a report but it doesn't work.
I tried with ""

      | search SITE="$tok_filtersite|s$ "

With this, I can save the report but the filter token doesn't work.
What should I do, please?

Re: How to save bracket syntax in a report

DavidHourani — Tue, 25 Jun 2019 08:33:04 GMT

Hi @jip31,

In your savedsearch keep the token as $tok_filtersite$ and when you call your saved search call it as follows :

...
 <query>| savedsearch "Your SavedSearch" tok_filtersite="$tok_filtersite|s$"</query>
...

You will send the escaped value directly to your saved search, no need to escape it twice.

Cheers,
David

Re: How to save bracket syntax in a report

jip31 — Tue, 25 Jun 2019 08:49:07 GMT

hi many thanks

Re: How to save bracket syntax in a report

jip31 — Tue, 25 Jun 2019 09:05:51 GMT

hummm
do I have to do something like this??

[| inputlookup host.csv 
    | table host] `CPU` tok_filtersite="$tok_filtersite|s$"
| where process_cpu_used_percent>80 
| bucket _time span=3m 
| lookup lookup_cmdb_fo_all.csv HOSTNAME as host output SITE 
| search SITE=$tok_filtersite|s$ 
| stats dc(host)

Re: How to save bracket syntax in a report

DavidHourani — Tue, 25 Jun 2019 09:08:22 GMT

Is this your saved search ? If so it should be like this :

 [| inputlookup host.csv 
     | table host] `CPU` tok_filtersite="$tok_filtersite$"
 | where process_cpu_used_percent>80 
 | bucket _time span=3m 
 | lookup lookup_cmdb_fo_all.csv HOSTNAME as host output SITE 
 | search SITE=$tok_filtersite$ 
 | stats dc(host)

And then when you call it from a dashboard, you call it like this :

 ...
  | savedsearch "Your SavedSearch" tok_filtersite="$tok_filtersite|s$"
 ...

Re: How to save bracket syntax in a report

jip31 — Tue, 25 Jun 2019 09:45:16 GMT

OK thanks...