topic Help on dropdown list token in Splunk Search

Help on dropdown list token

jip31 — Wed, 05 Jul 2023 15:08:03 GMT

I try to filter my table events from à dropdown list like this

Owner=$owner$

The item syntax in the dropdown lis is like REM\A-AA228339

I tried with Owner="$owner$" but it doesnt works

What is wrong please?

ITWhisperer — Wed, 05 Jul 2023 15:12:04 GMT

If you have backslashes in your string, you may need to escape them.

jip31 — Wed, 05 Jul 2023 16:54:20 GMT

Something like this?

REM"\"123467

If yes, is it possible to have aregex to do that because the item list of my dropdown list is imported automatically

Thanks

ITWhisperer — Wed, 05 Jul 2023 16:29:55 GMT

No, that is not escaping, that is quoting. Are you using / or \ as they are different?

jip31 — Wed, 05 Jul 2023 16:54:56 GMT

I use always \

REM\A-AA228339

ITWhisperer — Wed, 05 Jul 2023 22:10:35 GMT

Then try escaping it

REM\\A-AA228339