how do you pass square brackets in form inputs?

[cphair]

I have a field that contains square brackets, and I can't get my dashboard to search on it properly when it's used in an input token. It keeps telling me no results are found. The search works fine from the search bar, and the token value is being populated as I would expect in the URL (with the brackets encoded of course), so I'm guessing something is funny with the token interpolation. Is there some special way I need to handle brackets? I've tried escaping them with the backslash (multiple times), using their HTML encoding value, trying to escape with quotes...no luck.

Example:
<pre><choice value="foo[bar]">Foo Bar</choice></pre>

[woodcock]

OK, let's go hardcore and try thiese:

index=blah | where match(myField, "^$fooBarToken$$")
index=blah | where match(myField, "$fooBarToken$")
index=blah | where like(myField, "$fooBarToken$")

Also try swapping double-quotes for single-quotes. One of these should work.

[woodcock · Accepted solution]

Did you try using double-quotes around the token name in your search string like this:

index=blah myField="$fooBarToken$"

[cphair]

Ugh, it ended up being an error earlier in the search--nothing to do with the brackets. Printing out the field values like you suggested below showed it up. Thanks for your help.

[woodcock]

OK, well you have it now!

[cphair]

Yes, it is already enclosed in quotes. I've had to do that for tokens with special characters before, but the brackets seem to be really confusing something.

[woodcock]

Did you try single-quotes?

[cphair]

Yes--no luck.