Dashboards & Visualizations

documentation of token filter like "|s" (Simple XML)

andreas
Explorer

In the Simple XML Reference (Drilldown element "set") a " |s token filter" is mentioned, which should put quotes around a token value.

Example:
<set token="Token Name">sourcetype=$click.value|s$</set>

How does this token filter work exactly? Does it also escape double quotes in the token value?

Is there any documention for token filters?

Are there more token filters (in Simple XML)?

Tags (2)
1 Solution

dfoster_splunk
Splunk Employee
Splunk Employee

The |s filter performs search escaping, so it adds surrounding quotes and escapes quotes inside the search string.

Other builtin filters include:

  • |u - Escapes a value to be encoded in a URL, usually by adding percent escapes like %20.
  • |h - Escapes a value to be included in HTML. Details at http://underscorejs.org/#escape

Custom filters are supported too. See the following page:

View solution in original post

Lowell
Super Champion

For anyone following along at home.... A list of the built-in token filters available in the docs, here:

http://docs.splunk.com/Documentation/Splunk/6.5.0/Viz/tokens#Token_filters

dfoster_splunk
Splunk Employee
Splunk Employee

The |s filter performs search escaping, so it adds surrounding quotes and escapes quotes inside the search string.

Other builtin filters include:

  • |u - Escapes a value to be encoded in a URL, usually by adding percent escapes like %20.
  • |h - Escapes a value to be included in HTML. Details at http://underscorejs.org/#escape

Custom filters are supported too. See the following page:

andreas
Explorer

Perfect! 🙂 That answers all my questions.

0 Karma

Lowell
Super Champion

This could just be a bug in the answers site itself, but here's the full URL to the above documentation link:
http://dev.splunk.com/view/webframework-concepts/SP-CAAAEW4

0 Karma

andreas
Explorer

I understand the (potential) necessity und function of "|s" in this example. But where is there any documentation? Are there more "filters" like this? I've never seen this "|" syntax before. Is it possible to implement own filters?

somesoni2
SplunkTrust
SplunkTrust

If you see the example in the documentation, the token is used with a field name in the LHS (sourcetype). The term "sourcetype=$click.value$" may not work if the value contains a space, hence "|s" filter is used to prefix and suffix the value with double quotes. The second example there also explains alternate/direct way to enclosing the drilldown value with double quotes.
http://docs.splunk.com/Documentation/Splunk/6.1.2/Viz/PanelreferenceforSimplifiedXML#set

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...