Dashboards & Visualizations

How can I escape double quotes in a token to modify a search?

Communicator

I have a search which sometimes I want to do an append, and sometimes not - this should be driven by a checkbox in the GUI. The optional append looks like this:

| append [ search eventtype=x sourcetype=y host=z | eval series=if(like(source, "%vmstat_DB_%"), "CPU DB", source), | rename cpu_used as value | table _time series value ]

I have defined a checkbox like this:

< input type="checkbox" token="CPU_IN_TPS" searchWhenChanged="true">
        < choice value="
| append [ search eventtype=x sourcetype=y host=z | eval series=if(like(source, "%vmstat_DB_%"), "CPU DB", source), | rename cpu_used as value | table _time series value ]">ON< /choice>
      < /input>

And $CPU_IN_TPS$ goes at the end of my main search.

My problem is that double quotes are not accepted inside a token value. Is there a way of escaping them? Should I be using a macro instead?

Many thanks,
John Raftery

1 Solution

SplunkTrust
SplunkTrust

In XML you can use &quot; instead of ". It's working for me

<choice value="&quot; | append [ search eventtype=x sourcetype=y host=z | eval series=if(like(source, &quot;%vmstat_DB_%&quot;), &quot;CPU DB&quot;, source), | rename cpu_used as value | table _time series value ]&quot;">ON</choice>

View solution in original post

New Member

For the panel requiring the double quotes to be escaped (\"), add:
|rex mode=sed field=FIELD_REQUIRING_ESCAPES "s/\"/"\\""/g"

It's using a Linux sed equivalent to replace every occurrence of " (\") with \" ("\\""). Different than Linux syntax, but it's working for me...

0 Karma

SplunkTrust
SplunkTrust

In XML you can use &quot; instead of ". It's working for me

<choice value="&quot; | append [ search eventtype=x sourcetype=y host=z | eval series=if(like(source, &quot;%vmstat_DB_%&quot;), &quot;CPU DB&quot;, source), | rename cpu_used as value | table _time series value ]&quot;">ON</choice>

View solution in original post

Communicator

Never mind - I had the checkbox set up wrong. Thanks for your help!

0 Karma

Communicator

This solved the quote issue - thanks very much. Strangely, the commas seem to disappear in the search - I end up with
eval series=if(like(source "%vmstat_DB_%") "CPU DB" source
Did you have this as well?

0 Karma

SplunkTrust
SplunkTrust

not really. Below dashboard works perfect

<form>
  <label>TEST</label>
  <fieldset submitButton="false">
    <input type="checkbox" token="field1" searchWhenChanged="true">
      <choice value="| append [ |stats count| eval series=if(like(count, &quot;%vmstat_DB_%&quot;), &quot;CPU DB&quot;, count) | rename cpu_used as value | table _time series value ]">Test</choice>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>Test $field1$</title>
      <table>
        <search>
          <query>|stats count|eval count=100 $field1$</query>
          <earliest>0</earliest>
        </search>
      </table>
    </panel>
  </row>
</form>
0 Karma

Communicator

I get an error when trying to use the fieldset node:
XML Syntax Error: Row, on line=320, contains unknown node=fieldset on line=321.

What does this node do?

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!