Escaping input of fieldset text to allow search for word 'not'

[martind]

I'm having problems when searching for the word NOT in an input Field.

When searching for the text "DO NOT" in the text field i don't get any results. Clicking on the 'View Results' link i noticed splunk converts the input into id="DO" NOT.

How can i escape the Input Properly so the NOT word goes into the field search ( id="DO NOT" ) ? Example code below:

<form>
  <label>..</label>
  <searchTemplate>source="source.csv" MYFIELD=$id$ | timechart max(id)</searchTemplate>

  <fieldset>
    <input type="text" token="id" />
  </fieldset>

  <row>
    <chart>
      <title>Chart</title>
      <option name="charting.chart">line</option>
      <option name="charting.nullValueMode">gaps</option>
    </chart>
  </row>

</form>

[araitz · Accepted solution]

Splunk only interprets NOT as such when it is fully capitalized.

You can try to quote the string:

MYFIELD="$id$"

You might also consider using eval to lowercase the value:

http://www.splunk.com/base/Documentation/latest/SearchReference/CommonEvalFunctions

Alternatively, you can instruct your users to use 'not', 'Not', or something similar.

[martind]

that works perfectly 🙂 Thanks. Would be nice to have it somewhere in the docu, i searched for it but couldn't find anything about escaping (except XML Escaping)

[araitz]

Try the MYFIELD="$id$" first. If that fails, then let me know.

[martind]

i did not express myself clear, sorry. My Field value is from a text field.Do you know how to lower case that? I tried eval MYFIELD=lower($id$)

[araitz]

I added another (perhaps better) way to get Splunk to treat the value as a literal. Regarding your above question, try eval MYFIELD=lower(MYFIELD)

[martind]

can you give an example? tried: eval MYFIELD=lower("DO NOT")

[martind]

Thank's :). I did not know that Splunk is not case sensitive inside the text field