Token's value with slash

[tiagomiranda]

I created a dropdown Input for my dashboard and my token's name is "TEST\admin".On the search, Splunk doesn't understand the token's value, following an example:

source=dbx action_id_name = "$token$"
source=dbx action_id_name = "TEST\admin" - DOESN'T WORK
source=dbx action_id_name = "TEST\admin" - IT'S WORK

How Can I include one slash in the middle of the token's value? Like this "TEST\admin".

Best regards.

[somesoni2 · Accepted solution]

Try something like this

source=dbx action_id_name = [| gentimes start=-1 | eval search=replace("$token$","\\\\","\\\\\\\\") | table search] 

[tiagomiranda]

It worked perfectly!

Thank you!