How do I put my search string in a dashboard panel with a colon in the field name?

[mjm295]

Hi Guys

I have a search string which quotes field names with $ and works great. However, when I put that into a panel on a dashboard, I get the "waiting for input" message on the panel.

Search string:

index=aws-bill user:showback!=""  | eval showback=case(match($user:showback$, "IT Enterprise Services:*"), "INFRA", match($user:showback$, "IT:*"), "OtherIT", match($user:showback$, "Websites:*"), "WEBSITES", 1=1, "OLDDATA") | timechart sum(BlendedCost) as $ by showback useother=f limit=10

If I remove the $ quotes, eval complains about malformed expression due to the colon in the name.

So what am I doing wrong?

Mark

[richgalloway · Accepted solution]

Consider renaming the field to something without a colon in it.

[mjm295]

Thanks Rich - that's working now. never come across "rename" before.

[mjm295]

Thanks for the suggestion but how would I do that? I've tried:

index=aws-bill user:showback!=""  | rex field=_raw mode=sed "s/\://g" | eval showback=case(match(usershowback, "IT Enterprise Services:*"), "INFRA", match(usershowback, "IT:*"), "JUSTIT", match(usershowback, "Websites:*"), "WEBSITES", 1=1, "OLDDATA") | timechart sum(BlendedCost) as $ by showback useother=f limit=10

The colon is gone in the raw data but the eval is not picking it up.

[richgalloway]

Try this

index=aws-bill user:showback!=""  | rename "user:showback" as user_showback | eval showback=case(match($user_showback$, "IT Enterprise Services:*"), "INFRA", match($user_showback$, "IT:*"), "OtherIT", match($user_showback$, "Websites:*"), "WEBSITES", 1=1, "OLDDATA") | timechart sum(BlendedCost) as $ by showback useother=f limit=10