Multiple Dollar signs in Data cause issues when searching

[aelliott]

I have a Web Framework Dashboard that I have created that has a custom drill-down for a chart.
That drill-down sets a token for what was clicked on with it's value.
When using that value in another search, it makes the search invalid.
The value that is in the field contains multiple dollar signs and the search is thinking that it is a token.

So basically I have a token $token$ with values similar to "Item - >= $1 and < $2".
When using that in a search manager, since |token_safe is set for the $token$, the value with the two dollar signs is being counted as a token.

Since they are being counted as tokens and not values, the value is seen as null and makes all searches with that "token" not work.

I have found a workaround to replace all "$" with "*" within the javascript, but this does not seem to be good practice.

[aelliott]

I attempted that as well and it did the same thing, looks like it is a bug in the web framework per the answer i marked, thanks!

[somesoni2]

I am sorry. I actually wrote replacing "$" with "\$" (back slash dollar)

[ineeman · Accepted solution]

This is a bug in the Web Framework which should be fixed in Splunk 6.0.1 - it causes tokens in the SearchManager to be resolved twice, which in turn causes your issue.

[aelliott]

This was indeed fixed in 6.0.1
Thanks!

[mgroves_splunk]

We are targeting the end of 2013 for a release of 6.0.1, but that is just an estimate.

[aelliott]

Is there a timeframe in which 6.0.1 will be released?

[aelliott]

{% dropdown value="$volumeby$"|token_safe %}

{% searchmanager search=" ...$volumeby$... " |token_safe %}

Something similar to that .. now the $volumeby$ has 2 dollar signs in the values that are in the dropdown. When you select it, the searches that go off that token are invalidated because of the dollar signs. The $volumeby$ is replaced by VolumeBy="Item - >= $1 and < $2" and then splunk sees that its token safe and decides that $1 and < $ is a token so the search does not work.

[dfoster_splunk]

Not sure I fully understand your setup.

Sounds like you have something like:
{% chart selectedValue="$token$"|token_safe %}
{% searchmanager search="$token$"|token_safe %}

If this isn't correct, could you update your question with more details?

[aelliott]

No, it's the search that fails when it sees the two dollar signs in the data, replacing it will dollar signs again would still have the same effect.