Archive

Multivalues not working with Acronym

splunksplunk232
Explorer

HI all,

I have a multi values filter based on a query from Database and the query return string with apostrophes(Acronym).
for example SQ"L.
In the drop-down values it displays the string until the quota which in this case is SQ.
How i configure the multi values to work with string that continues apostrophes.

Thank you in advance

0 Karma
1 Solution

splunksplunk232
Explorer

The problem solved, apperently that when splunk displays information it finds info between two apostrophes.
so if the data looks like

 id=1 value="ab"c"

when the query will be

 index="some_index"
 | table id value 

the table will be like

 1 ab

but the _raw will be noramal

 id=1 value="ab"c" 

so i simply created a field extraction to get the value.

View solution in original post

0 Karma

splunksplunk232
Explorer

The problem solved, apperently that when splunk displays information it finds info between two apostrophes.
so if the data looks like

 id=1 value="ab"c"

when the query will be

 index="some_index"
 | table id value 

the table will be like

 1 ab

but the _raw will be noramal

 id=1 value="ab"c" 

so i simply created a field extraction to get the value.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Please share the query that builds the drop-down menu.

---
If this reply helps you, an upvote would be appreciated.
0 Karma