Sideview, $search$, REX, and the HTML module

[cramasta]

I was messing with the $search$, $postProcess$ variables in my dashboard the other day to show the search string using the html module. I noticed that the field name of the matching group for any regex will be removed. Is there a work around for this. Only thing I could think of was to use the Redirector + Button module to launch a flashtimeline view loading the $search$ | $postProcess$

For example if my search has

| rex "data/(?<ServiceName>[\S][^\/]+)"

the following will be displayed in the HTML module

| rex "data/(?[\S][^\/]+)"

*haha looks like the text box here on answers will do the same thing unless I enclose the entire rex with a backtick

[sideview · Accepted solution]

If you're on the latest version of 2.6.5 which only released a few days ago, you can set the
htmlEscapeKeys param of the HTML module to

 `<param name="htmlEscapeKeys">search,postProcess</param>` 

and that will tell it to remove unsafe html characters before inserting those tokens. What's happening is that by default the HTML module assumes you don't want such characters escaped, because for instance you might be trying to insert your own chunk of dynamically constructed HTML into the page.

If you have a version older than 2.6.5, there were ways of doing this but they were clunky. Here's one way: http://answers.splunk.com/answers/85210/unable-to-use-foo-value-containing-xml-in-html-module and another way was to just put in a couple lines of customBehavior Javascript (not everyone's favorite option certainly).

Update to the latest version though because now it's very easy.

http://sideviewapps.com/apps/sideview-utils

http://sideviewapps.com/apps/sideview-utils/release-notes/