In the Simple XML Reference (Drilldown element "set") a " |s token filter" is mentioned, which should put quotes around a token value.
<set token="Token Name">sourcetype=$click.value|s$</set>
How does this token filter work exactly? Does it also escape double quotes in the token value?
Is there any documention for token filters?
Are there more token filters (in Simple XML)?
If you see the example in the documentation, the token is used with a field name in the LHS (sourcetype). The term "sourcetype=$click.value$" may not work if the value contains a space, hence "|s" filter is used to prefix and suffix the value with double quotes. The second example there also explains alternate/direct way to enclosing the drilldown value with double quotes.
I understand the (potential) necessity und function of "|s" in this example. But where is there any documentation? Are there more "filters" like this? I've never seen this "|" syntax before. Is it possible to implement own filters?
The |s filter performs search escaping, so it adds surrounding quotes and escapes quotes inside the search string.
Other builtin filters include:
Custom filters are supported too. See the following page: