Dashboards & Visualizations

How to use escape characters in an input tag in an XML dashboard?

Motivator

how do I escape the " (double quote) character in the below code?

<input type="dropdown" token="short_long_view2">
  <label>Views:             e.g. long -> last 30 days, short -> yesterday           </label>
  <choice value="| strcat subrackNo "-" SlotNo "-" boardType fields | timechart span=1h">>short</choice>
  <!-- <choice value="earliest=-30d@d | strcat subrackNo "-" SlotNo "-" boardType fields | timechart span=1d">long</choice> --> 
  <choice value="earliest=-30d@d | strcat subrackNo "-" SlotNo "-" boardType fields | timechart span=1d">long</choice>

  <default>short</default>
</input>

The line that is troubling me is
&lt;choice value="| strcat subrackNo "-" SlotNo "-" boardType fields | timechart span=1h"&gt;&gt;short&lt;/choice&gt;

Is there away of escaping the " (double quote) or should I just write something like?
eval fields=subrackNo. "+" .SlotNo. "+" .boardType but this will present the same problem with the "(double quote)

Any ideas? or is my approach very bad?

0 Karma
1 Solution

Builder

I see there are 2 ">" symbols before short. Is that the problem?

View solution in original post

0 Karma

Influencer

What if, instead of carrying so much of your search along in your selector, you passed simpler values, and just interpreted them in your search? So your xml would then be like (note that default takes the default value, not the display):

<input type="dropdown" token="short_long_view">
    <label>Views:              e.g. long -> last 30 days, short -> yesterday             </label>
    <choice value="s">short</choice>
    <choice value="l">long</choice>
    <default>s</default>
</input>

You could encode all of the corresponding values in your search using subsearches something like:

EXISTING BASE SEARCH [noop | stats count | eval earliest=case("$short_long_view$"=="s","-d@d","$short_long_view$"=="l","-30d@d") | return earliest]
| strcat subrackNo "-" SlotNo "-" boardType fields
| timechart [noop | stats count | eval span=case("$short_long_view$"=="s","1h","$short_long_view$"=="1d") | return span] EXISTING REMAINDER

Now, if you had a lookup (appropriate permissions required of course) with at least 3 columns, key (values: s, l) , earliest (values "-d@d", "-30d@d"), span (values "1h","1d"). For this example, we'll call the lookup view:

EXISTING BASE SEARCH [inputlookup view | where key="$short_long_view$" | return earliest]
| strcat subrackNo "-" SlotNo "-" boardType fields
| timechart [inputlookup view | where key="$short_long_view$" | return span]

Add a column of display to this lookup, and you could power your dropdown too!

<input type="dropdown" token="short_long_view">
     <label>Views:              e.g. long -> last 30 days, short -> yesterday             </label>
     <populatingSearch fieldForLabel="display" fieldForValue="key">| inputlookup view</populatingSearch>
     <default>s</default>
 </input>
0 Karma

Motivator

good to know that these methods exist but might be a bit over complex for me at this stage.

0 Karma

Builder

I see there are 2 ">" symbols before short. Is that the problem?

View solution in original post

0 Karma

Motivator

tks, good spot.

0 Karma

Motivator

i tried it like this, but the formatting did not work as well

&lt;choice value="| strcat subrackNo '-' SlotNo '-' boardType fields | timechart span=1h"&gt;short&lt;/choice&gt;

but this eventuall done it, using single quote and then double quotes inside that

&lt;choice value='| strcat subrackNo "-" SlotNo "-" boardType fields | timechart span=1h'&gt;short&lt;/choice&gt;
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!