Dashboards & Visualizations

Escaping input of fieldset text to allow search for word 'not'

martind
New Member

I'm having problems when searching for the word NOT in an input Field.

When searching for the text "DO NOT" in the text field i don't get any results. Clicking on the 'View Results' link i noticed splunk converts the input into id="DO" NOT.

How can i escape the Input Properly so the NOT word goes into the field search ( id="DO NOT" ) ? Example code below:

<form>
  <label>..</label>
  <searchTemplate>source="source.csv" MYFIELD=$id$ | timechart max(id)</searchTemplate>

  <fieldset>
    <input type="text" token="id" />
  </fieldset>

  <row>
    <chart>
      <title>Chart</title>
      <option name="charting.chart">line</option>
      <option name="charting.nullValueMode">gaps</option>
    </chart>
  </row>

</form>
Tags (1)
0 Karma
1 Solution

araitz
Splunk Employee
Splunk Employee

Splunk only interprets NOT as such when it is fully capitalized.

You can try to quote the string:

MYFIELD="$id$"

You might also consider using eval to lowercase the value:

http://www.splunk.com/base/Documentation/latest/SearchReference/CommonEvalFunctions

Alternatively, you can instruct your users to use 'not', 'Not', or something similar.

View solution in original post

araitz
Splunk Employee
Splunk Employee

Splunk only interprets NOT as such when it is fully capitalized.

You can try to quote the string:

MYFIELD="$id$"

You might also consider using eval to lowercase the value:

http://www.splunk.com/base/Documentation/latest/SearchReference/CommonEvalFunctions

Alternatively, you can instruct your users to use 'not', 'Not', or something similar.

martind
New Member

that works perfectly :slightly_smiling_face: Thanks. Would be nice to have it somewhere in the docu, i searched for it but couldn't find anything about escaping (except XML Escaping)

0 Karma

araitz
Splunk Employee
Splunk Employee

Try the MYFIELD="$id$" first. If that fails, then let me know.

0 Karma

martind
New Member

i did not express myself clear, sorry. My Field value is from a text field.Do you know how to lower case that? I tried eval MYFIELD=lower($id$)

0 Karma

araitz
Splunk Employee
Splunk Employee

I added another (perhaps better) way to get Splunk to treat the value as a literal. Regarding your above question, try eval MYFIELD=lower(MYFIELD)

0 Karma

martind
New Member

can you give an example? tried: eval MYFIELD=lower("DO NOT")

0 Karma

martind
New Member

Thank's :). I did not know that Splunk is not case sensitive inside the text field

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...