Dashboards & Visualizations
Highlighted

How can I escape double quotes in a token to modify a search?

Communicator

I have a search which sometimes I want to do an append, and sometimes not - this should be driven by a checkbox in the GUI. The optional append looks like this:

| append [ search eventtype=x sourcetype=y host=z | eval series=if(like(source, "%vmstat_DB_%"), "CPU DB", source), | rename cpu_used as value | table _time series value ]

I have defined a checkbox like this:

< input type="checkbox" token="CPU_IN_TPS" searchWhenChanged="true">
        < choice value="
| append [ search eventtype=x sourcetype=y host=z | eval series=if(like(source, "%vmstat_DB_%"), "CPU DB", source), | rename cpu_used as value | table _time series value ]">ON< /choice>
      < /input>

And $CPU_IN_TPS$ goes at the end of my main search.

My problem is that double quotes are not accepted inside a token value. Is there a way of escaping them? Should I be using a macro instead?

Many thanks,
John Raftery

Highlighted

Re: How can I escape double quotes in a token to modify a search?

SplunkTrust
SplunkTrust

In XML you can use &quot; instead of ". It's working for me

<choice value="&quot; | append [ search eventtype=x sourcetype=y host=z | eval series=if(like(source, &quot;%vmstat_DB_%&quot;), &quot;CPU DB&quot;, source), | rename cpu_used as value | table _time series value ]&quot;">ON</choice>

View solution in original post

Highlighted

Re: How can I escape double quotes in a token to modify a search?

Communicator

This solved the quote issue - thanks very much. Strangely, the commas seem to disappear in the search - I end up with
eval series=if(like(source "%vmstatDB%") "CPU DB" source
Did you have this as well?

0 Karma
Highlighted

Re: How can I escape double quotes in a token to modify a search?

SplunkTrust
SplunkTrust

not really. Below dashboard works perfect

<form>
  <label>TEST</label>
  <fieldset submitButton="false">
    <input type="checkbox" token="field1" searchWhenChanged="true">
      <choice value="| append [ |stats count| eval series=if(like(count, &quot;%vmstat_DB_%&quot;), &quot;CPU DB&quot;, count) | rename cpu_used as value | table _time series value ]">Test</choice>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>Test $field1$</title>
      <table>
        <search>
          <query>|stats count|eval count=100 $field1$</query>
          <earliest>0</earliest>
        </search>
      </table>
    </panel>
  </row>
</form>
0 Karma
Highlighted

Re: How can I escape double quotes in a token to modify a search?

Communicator

I get an error when trying to use the fieldset node:
XML Syntax Error: Row, on line=320, contains unknown node=fieldset on line=321.

What does this node do?

0 Karma
Highlighted

Re: How can I escape double quotes in a token to modify a search?

Communicator

Never mind - I had the checkbox set up wrong. Thanks for your help!

0 Karma
Highlighted

Re: How can I escape double quotes in a token to modify a search?

New Member

For the panel requiring the double quotes to be escaped (\"), add:
|rex mode=sed field=FIELDREQUIRINGESCAPES "s/\"/"\\""/g"

It's using a Linux sed equivalent to replace every occurrence of " (\") with \" ("\\""). Different than Linux syntax, but it's working for me...

0 Karma