Why am I not able to save search in dashboard because of $ sign in search?

[shaileshmali]

Not able to save search in dashboard because of $ sign in search query.

match(RelativeURI,"/identity/enhanced-authentication/tasks/~/search") AND match (HttpMethod,"POST"), "TASK1",
match(RelativeURI,"/identity/enhanced-authentication/tasks$") AND match (HttpMethod,"POST"), "TASK2",
match(RelativeURI,"/identity/enhanced-authentication/tasks/*") AND match (HttpMethod,"POST"), "TASK3",
match(RelativeURI,"/identity/enhanced-authentication/tasks$") AND match (HttpMethod,"GET"), "TASK4",
match(RelativeURI,"/identity/enhanced-authentication/tasks/*") AND match (HttpMethod,"GET"), "TASK5")

[micahkemp]

Dashboards use $ to denote fields requiring input, such as $earliest, $latest, etc. It's probably failing to correctly parse that.

Try escaping the dollar signs in your search by doubling them up:

     match(RelativeURI,"/identity/enhanced-authentication/tasks/~/search") AND match (HttpMethod,"POST"), "TASK1",
     match(RelativeURI,"/identity/enhanced-authentication/tasks$$") AND match (HttpMethod,"POST"), "TASK2",
     match(RelativeURI,"/identity/enhanced-authentication/tasks/*") AND match (HttpMethod,"POST"), "TASK3",
     match(RelativeURI,"/identity/enhanced-authentication/tasks$$") AND match (HttpMethod,"GET"), "TASK4",
     match(RelativeURI,"/identity/enhanced-authentication/tasks/*") AND match (HttpMethod,"GET"), "TASK5")

[niketn]

Agree to @micahkemp's point, due to two $ signs in the same pipe, it is making Splunk search to treat the same as token in a dashboard. Escaping the $ sign with $$ should work for you.

Here is another option for you by breaking the case statement in two parts with a run anywhere example:

| makeresults
| eval RelativeURI="/identity/enhanced-authentication/tasks/*"
| eval HttpMethod="GET"
| eval test=case(
 match(RelativeURI,"/identity/enhanced-authentication/tasks/~/search") AND match (HttpMethod,"POST"), "TASK1",
 match(RelativeURI,"/identity/enhanced-authentication/tasks$") AND match (HttpMethod,"POST"), "TASK2",
 match(RelativeURI,"/identity/enhanced-authentication/tasks/*") AND match (HttpMethod,"POST"), "TASK3")
| eval test=case(match(RelativeURI,"/identity/enhanced-authentication/tasks$") AND match (HttpMethod,"GET"), "TASK4",
 match(RelativeURI,"/identity/enhanced-authentication/tasks/*") AND match (HttpMethod,"GET"), "TASK5",
 true(),test)
| table RelativeURI HttpMethod test