Dashboards & Visualizations

Multivalues not working with Acronym

splunksplunk232
Explorer

HI all,

I have a multi values filter based on a query from Database and the query return string with apostrophes(Acronym).
for example SQ"L.
In the drop-down values it displays the string until the quota which in this case is SQ.
How i configure the multi values to work with string that continues apostrophes.

Thank you in advance

0 Karma
1 Solution

splunksplunk232
Explorer

The problem solved, apperently that when splunk displays information it finds info between two apostrophes.
so if the data looks like

 id=1 value="ab"c"

when the query will be

 index="some_index"
 | table id value 

the table will be like

 1 ab

but the _raw will be noramal

 id=1 value="ab"c" 

so i simply created a field extraction to get the value.

View solution in original post

0 Karma

splunksplunk232
Explorer

The problem solved, apperently that when splunk displays information it finds info between two apostrophes.
so if the data looks like

 id=1 value="ab"c"

when the query will be

 index="some_index"
 | table id value 

the table will be like

 1 ab

but the _raw will be noramal

 id=1 value="ab"c" 

so i simply created a field extraction to get the value.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Please share the query that builds the drop-down menu.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...