Dashboards & Visualizations

How to use escape characters in an input tag in an XML dashboard?

HattrickNZ
Motivator

how do I escape the " (double quote) character in the below code?

<input type="dropdown" token="short_long_view2">
  <label>Views:             e.g. long -> last 30 days, short -> yesterday           </label>
  <choice value="| strcat subrackNo "-" SlotNo "-" boardType fields | timechart span=1h">>short</choice>
  <!-- <choice value="earliest=-30d@d | strcat subrackNo "-" SlotNo "-" boardType fields | timechart span=1d">long</choice> --> 
  <choice value="earliest=-30d@d | strcat subrackNo "-" SlotNo "-" boardType fields | timechart span=1d">long</choice>

  <default>short</default>
</input>

The line that is troubling me is
&lt;choice value="| strcat subrackNo "-" SlotNo "-" boardType fields | timechart span=1h"&gt;&gt;short&lt;/choice&gt;

Is there away of escaping the " (double quote) or should I just write something like?
eval fields=subrackNo. "+" .SlotNo. "+" .boardType but this will present the same problem with the "(double quote)

Any ideas? or is my approach very bad?

0 Karma
1 Solution

dineshraj9
Builder

I see there are 2 ">" symbols before short. Is that the problem?

View solution in original post

0 Karma

acharlieh
Influencer

What if, instead of carrying so much of your search along in your selector, you passed simpler values, and just interpreted them in your search? So your xml would then be like (note that default takes the default value, not the display):

<input type="dropdown" token="short_long_view">
    <label>Views:              e.g. long -> last 30 days, short -> yesterday             </label>
    <choice value="s">short</choice>
    <choice value="l">long</choice>
    <default>s</default>
</input>

You could encode all of the corresponding values in your search using subsearches something like:

EXISTING BASE SEARCH [noop | stats count | eval earliest=case("$short_long_view$"=="s","-d@d","$short_long_view$"=="l","-30d@d") | return earliest]
| strcat subrackNo "-" SlotNo "-" boardType fields
| timechart [noop | stats count | eval span=case("$short_long_view$"=="s","1h","$short_long_view$"=="1d") | return span] EXISTING REMAINDER

Now, if you had a lookup (appropriate permissions required of course) with at least 3 columns, key (values: s, l) , earliest (values "-d@d", "-30d@d"), span (values "1h","1d"). For this example, we'll call the lookup view:

EXISTING BASE SEARCH [inputlookup view | where key="$short_long_view$" | return earliest]
| strcat subrackNo "-" SlotNo "-" boardType fields
| timechart [inputlookup view | where key="$short_long_view$" | return span]

Add a column of display to this lookup, and you could power your dropdown too!

<input type="dropdown" token="short_long_view">
     <label>Views:              e.g. long -> last 30 days, short -> yesterday             </label>
     <populatingSearch fieldForLabel="display" fieldForValue="key">| inputlookup view</populatingSearch>
     <default>s</default>
 </input>
0 Karma

HattrickNZ
Motivator

good to know that these methods exist but might be a bit over complex for me at this stage.

0 Karma

dineshraj9
Builder

I see there are 2 ">" symbols before short. Is that the problem?

0 Karma

HattrickNZ
Motivator

tks, good spot.

0 Karma

HattrickNZ
Motivator

i tried it like this, but the formatting did not work as well

&lt;choice value="| strcat subrackNo '-' SlotNo '-' boardType fields | timechart span=1h"&gt;short&lt;/choice&gt;

but this eventuall done it, using single quote and then double quotes inside that

&lt;choice value='| strcat subrackNo "-" SlotNo "-" boardType fields | timechart span=1h'&gt;short&lt;/choice&gt;
0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...