Dashboards & Visualizations

How do you escape characters in a form search query?

jacubero
Explorer

I have the following query in a form:

| inputlookup input.csv | fields feature values | spath input=values | fields - values | rename {}.count AS count | rename {}.value AS value | eval reading=mvzip(count, value) | mvexpand reading | makemv reading delim="," | eval count=mvindex(reading, 0) | eval value=mvindex(reading, 1) | fields - reading | outputlookup ouput.csv

where input.csv has a column called values with this kind of data:

[{"value":"6","count":835},{"value":"7","count":794},{"value":"5","count":733},{"value":"1","count":680},{"value":"4","count":675},{"value":"2","count":668},{"value":"3","count":615}]

This query works like a charm in the Splunk Web search form, but I cannot make it work in a dashboard/form. I am using the following XML code without success:

  <search>
    <query>| inputlookup input.csv | fields feature values | spath input=values | fields - values | rename {}.count AS count | rename {}.value AS value | eval reading=mvzip(count, value) | mvexpand reading | makemv reading delim=&quot;,&quot; | eval count=mvindex(reading, 0) | eval value=mvindex(reading, 1) | fields - reading | outputlookup output.csv</query>
  </search>

Am I missing something? I suspect that there must be a problem with escaping characters but I am not fully sure.

0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

@jacubero

Can you please try this?

   <search>
     <query>| inputlookup input.csv | fields feature values | spath input=values | fields - values | rename "{}.count" AS count | rename "{}.value" AS value | eval reading=mvzip(count, value) | mvexpand reading | makemv reading delim=&quot;,&quot; | eval count=mvindex(reading, 0) | eval value=mvindex(reading, 1) | fields - reading | outputlookup output.csv</query>
   </search>

OR

  <search>
     <query><![CDATA[| inputlookup input.csv | fields feature values | spath input=values | fields - values | rename "{}.count" AS count | rename "{}.value" AS value | eval reading=mvzip(count, value) | mvexpand reading | makemv reading delim="," | eval count=mvindex(reading, 0) | eval value=mvindex(reading, 1) | fields - reading | outputlookup output.csv]]></query>
   </search>

Thanks

View solution in original post

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@jacubero

Can you please try this?

   <search>
     <query>| inputlookup input.csv | fields feature values | spath input=values | fields - values | rename "{}.count" AS count | rename "{}.value" AS value | eval reading=mvzip(count, value) | mvexpand reading | makemv reading delim=&quot;,&quot; | eval count=mvindex(reading, 0) | eval value=mvindex(reading, 1) | fields - reading | outputlookup output.csv</query>
   </search>

OR

  <search>
     <query><![CDATA[| inputlookup input.csv | fields feature values | spath input=values | fields - values | rename "{}.count" AS count | rename "{}.value" AS value | eval reading=mvzip(count, value) | mvexpand reading | makemv reading delim="," | eval count=mvindex(reading, 0) | eval value=mvindex(reading, 1) | fields - reading | outputlookup output.csv]]></query>
   </search>

Thanks

0 Karma

jacubero
Explorer

It works great! Thank you.

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

Glad to help you.

0 Karma

vishaltaneja070
Motivator

Hello @jacubero
I think the issue is with curly brackets.

try to use CDAT tags if that works for you.

As we have many ways to handle this at index time but as you are doing inputlookup so not much option available :
https://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf#Structured_Data_Header_Extractio...

https://answers.splunk.com/answers/494335/how-to-deal-with-curly-brackets-in-field-names-cre.html
0 Karma

jacubero
Explorer

I tried CDATA as follows but it doesn't work either:

  <search>
    <query><![CDATA[| inputlookup input.csv | fields feature values | spath input=values | fields - values | rename {}.count AS count | rename {}.value AS value | eval reading=mvzip(count, value) | mvexpand reading | makemv reading delim="," | eval count=mvindex(reading, 0) | eval value=mvindex(reading, 1) | fields - reading | outputlookup output.csv]]></query>
  </search>
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...