Dashboards & Visualizations

Drilldown: error using a string with single double-quote in the token field

Cris
Explorer

I have a form with the drilldown function but when I try to pass the token with a single double quote I obtain the error:

PARSER: Applying intentions failed Unbalanced quotes.

Example:
No problem passing the value FOO or BAR but error with the value DB"DB

How can avoid that error?

I can post the example data and the forms if is needed.

Thanks a lot.

Tags (2)
0 Karma

ayme
Splunk Employee
Splunk Employee

Before you render your results in a table in the first place, escape any of the quotes of field values which are drilldown-able

.. | rex field=mydrilldown_field mode=sed "s/\"/\\\"/g"

..that way, we can search the index with that token.

0 Karma

aholzer
Motivator

From the brief research I did, you seem to be out of luck. It looks like you have to do some regex manipulation at the index time, or transforms. See these two Q&As:

http://splunk-base.splunk.com/answers/29961/how-can-i-extract-a-quoted-field-value-that-includes-a-q...

http://splunk-base.splunk.com/answers/3231/escaping-characters-in-an-event

Good luck

aholzer
Motivator

Oh I see, your problem is that the value in the field is DB"DB, not that the name of the field/token is DB"DB.

0 Karma

Cris
Explorer

Thank you for the answer but the problem is that I select a row on my table (with drill down function) where I need detailed information and I can not change the token string by hand. Sometimes the passed field is a simple string (like FOO etc.) and sometimes the string has a double-quote character (like DB"DB)...
A workaround could be change the string at index time, for example replacing every double-quote with two single-quote, but I prefer do not change the original data.

0 Karma

aholzer
Motivator

Try using the xml predefined character name instead of actual quotes: &quot\;

Something like: DB&quot\;DB
Instead of: DB"DB

http://en.wikipedia.org/wiki/List_of_XML_and_HTML_character_entity_references

0 Karma
Get Updates on the Splunk Community!

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...