Dashboards & Visualizations

Why am I not able to save search in dashboard because of $ sign in search?

shaileshmali
Path Finder

Not able to save search in dashboard because of $ sign in search query.

match(RelativeURI,"/identity/enhanced-authentication/tasks/~/search") AND match (HttpMethod,"POST"), "TASK1",
match(RelativeURI,"/identity/enhanced-authentication/tasks$") AND match (HttpMethod,"POST"), "TASK2",
match(RelativeURI,"/identity/enhanced-authentication/tasks/*") AND match (HttpMethod,"POST"), "TASK3",
match(RelativeURI,"/identity/enhanced-authentication/tasks$") AND match (HttpMethod,"GET"), "TASK4",
match(RelativeURI,"/identity/enhanced-authentication/tasks/*") AND match (HttpMethod,"GET"), "TASK5")
0 Karma

micahkemp
Champion

Dashboards use $ to denote fields requiring input, such as $earliest, $latest, etc. It's probably failing to correctly parse that.

Try escaping the dollar signs in your search by doubling them up:

     match(RelativeURI,"/identity/enhanced-authentication/tasks/~/search") AND match (HttpMethod,"POST"), "TASK1",
     match(RelativeURI,"/identity/enhanced-authentication/tasks$$") AND match (HttpMethod,"POST"), "TASK2",
     match(RelativeURI,"/identity/enhanced-authentication/tasks/*") AND match (HttpMethod,"POST"), "TASK3",
     match(RelativeURI,"/identity/enhanced-authentication/tasks$$") AND match (HttpMethod,"GET"), "TASK4",
     match(RelativeURI,"/identity/enhanced-authentication/tasks/*") AND match (HttpMethod,"GET"), "TASK5")

niketn
Legend

Agree to @micahkemp's point, due to two $ signs in the same pipe, it is making Splunk search to treat the same as token in a dashboard. Escaping the $ sign with $$ should work for you.

Here is another option for you by breaking the case statement in two parts with a run anywhere example:

| makeresults
| eval RelativeURI="/identity/enhanced-authentication/tasks/*"
| eval HttpMethod="GET"
| eval test=case(
 match(RelativeURI,"/identity/enhanced-authentication/tasks/~/search") AND match (HttpMethod,"POST"), "TASK1",
 match(RelativeURI,"/identity/enhanced-authentication/tasks$") AND match (HttpMethod,"POST"), "TASK2",
 match(RelativeURI,"/identity/enhanced-authentication/tasks/*") AND match (HttpMethod,"POST"), "TASK3")
| eval test=case(match(RelativeURI,"/identity/enhanced-authentication/tasks$") AND match (HttpMethod,"GET"), "TASK4",
 match(RelativeURI,"/identity/enhanced-authentication/tasks/*") AND match (HttpMethod,"GET"), "TASK5",
 true(),test)
| table RelativeURI HttpMethod test
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...