https://community.splunk.com/t5/Splunk-Search/How-to-get-rid-of-the-the-spaces-in-token-output/m-p/586881#M204404 <BLOCKQUOTE><HR />I also tried using a "static" value.&nbsp; In all cases there is a space before and after<HR /></BLOCKQUOTE><P>If static value still cause space before and after, maybe they are introduced inadvertently in token prefix and suffix. &nbsp;Inspect Simple XML Source ("Source" in editor), see if there are elements like</P><LI-CODE lang="markup"> &lt;prefix&gt; &lt;/prefix&gt; &lt;suffix&gt; &lt;/suffix&gt;</LI-CODE><P>in the &lt;input/&gt; entity. (I used this to simulate your condition when testing solution.)&nbsp;</P> Mon, 28 Feb 2022 17:41:09 GMT yuanliu 2022-02-28T17:41:09Z https://community.splunk.com/t5/Splunk-Search/How-to-get-rid-of-the-the-spaces-in-token-output/m-p/586504#M204297 <P>Trying to run a query that has a token field.&nbsp; The output injects a space before and after the token provided keyword, which breaks the query..&nbsp; Simple, but baffling.&nbsp;</P> <P>Original query</P> <P>&nbsp;</P> <P>&nbsp;</P> <LI-CODE lang="markup">|inputlookup somelookup.csv | eval raw="" | foreach * [eval raw=raw.",".coalesce('&lt;&lt;FIELD&gt;&gt;',"") ] | search raw="*$token$*" | table field1, field2, field3</LI-CODE> <P>&nbsp;</P> <P>&nbsp;</P> <P>Output of query</P> <P>&nbsp;</P> <P>&nbsp;</P> <LI-CODE lang="markup">|inputlookup somelookup.csv | eval raw="" | foreach * [eval raw=raw.",".coalesce('&lt;&lt;FIELD&gt;&gt;',"") ] | search raw="* &lt;keyword&gt; *" | table field1, field2, field3</LI-CODE> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>How do I get rid of the spaces before and after the keyword?</P> Thu, 24 Feb 2022 22:43:08 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-rid-of-the-the-spaces-in-token-output/m-p/586504#M204297 tlmayes 2022-02-24T22:43:08Z https://community.splunk.com/t5/Splunk-Search/How-to-get-rid-of-the-the-spaces-in-token-output/m-p/586553#M204314 <P>Although you may be able to rid the spaces <EM>after</EM> they have been passed to your panel, it would be much better if you examine the input to figure out why the token has to pass spaces. &nbsp;Are spaces expected in some other panels?</P> Fri, 25 Feb 2022 08:09:02 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-rid-of-the-the-spaces-in-token-output/m-p/586553#M204314 yuanliu 2022-02-25T08:09:02Z https://community.splunk.com/t5/Splunk-Search/How-to-get-rid-of-the-the-spaces-in-token-output/m-p/586598#M204328 <P>The query involves only two components:&nbsp; an input keyword provided by a static list of tokens form a dashboard input, and the master lookup table in the original query.&nbsp;</P> Fri, 25 Feb 2022 13:19:27 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-rid-of-the-the-spaces-in-token-output/m-p/586598#M204328 tlmayes 2022-02-25T13:19:27Z https://community.splunk.com/t5/Splunk-Search/How-to-get-rid-of-the-the-spaces-in-token-output/m-p/586642#M204341 <BLOCKQUOTE><HR />The query involves only two components:&nbsp; an input keyword provided by a static list of tokens form a dashboard input, and the master lookup table in the original query.&nbsp;<HR /></BLOCKQUOTE><P>Meaning that you cannot redo the static input? &nbsp;Unless the spaces are useful in some context, why not get rid of them in input?</P><P>This said, a quick fix can be to switch from search to&nbsp;<A href="https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Where" target="_blank" rel="noopener">where</A><SPAN>&nbsp;command,&nbsp;</SPAN><A href="https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/TextFunctions#trim.28X.2CY.29" target="_blank" rel="noopener">trim()</A><SPAN>&nbsp;spaces from $token$.</SPAN></P><P>&nbsp;</P><LI-CODE lang="markup">|inputlookup somelookup.csv | eval raw="" | foreach * [eval raw=raw.",".coalesce('&lt;&lt;FIELD&gt;&gt;',"") ] | where raw LIKE "%".trim("$token$")."%" | table field1, field2, field3</LI-CODE><P>&nbsp;</P><P>&nbsp;</P> Fri, 25 Feb 2022 17:49:57 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-rid-of-the-the-spaces-in-token-output/m-p/586642#M204341 yuanliu 2022-02-25T17:49:57Z https://community.splunk.com/t5/Splunk-Search/How-to-get-rid-of-the-the-spaces-in-token-output/m-p/586835#M204388 <P>For all that responded, appreciate your responses.&nbsp; I removed EVERYTHING between the '| inputputlook" call and the table output and replaced with something as simple as:&nbsp;</P><LI-CODE lang="markup">|inputlookup somelookup.csv | search field1=$token$ | table field1, field2, field3</LI-CODE><P>&nbsp;The output still contains a space before and after the token value.&nbsp;<BR /><BR />BTW, the original token value was a value pulled from a look.&nbsp; I also tried using a "static" value.&nbsp; In all cases there is a space before and after</P> Mon, 28 Feb 2022 12:36:48 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-rid-of-the-the-spaces-in-token-output/m-p/586835#M204388 tlmayes 2022-02-28T12:36:48Z https://community.splunk.com/t5/Splunk-Search/How-to-get-rid-of-the-the-spaces-in-token-output/m-p/586881#M204404 <BLOCKQUOTE><HR />I also tried using a "static" value.&nbsp; In all cases there is a space before and after<HR /></BLOCKQUOTE><P>If static value still cause space before and after, maybe they are introduced inadvertently in token prefix and suffix. &nbsp;Inspect Simple XML Source ("Source" in editor), see if there are elements like</P><LI-CODE lang="markup"> &lt;prefix&gt; &lt;/prefix&gt; &lt;suffix&gt; &lt;/suffix&gt;</LI-CODE><P>in the &lt;input/&gt; entity. (I used this to simulate your condition when testing solution.)&nbsp;</P> Mon, 28 Feb 2022 17:41:09 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-rid-of-the-the-spaces-in-token-output/m-p/586881#M204404 yuanliu 2022-02-28T17:41:09Z