Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Dashboards & Visualizations
- :
- Re: how do you pass square brackets in form inputs...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have a field that contains square brackets, and I can't get my dashboard to search on it properly when it's used in an input token. It keeps telling me no results are found. The search works fine from the search bar, and the token value is being populated as I would expect in the URL (with the brackets encoded of course), so I'm guessing something is funny with the token interpolation. Is there some special way I need to handle brackets? I've tried escaping them with the backslash (multiple times), using their HTML encoding value, trying to escape with quotes...no luck.
Example:
<pre><choice value="foo[bar]">Foo Bar</choice></pre>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Did you try using double-quotes around the token name in your search string like this:
index=blah myField="$fooBarToken$"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
OK, let's go hardcore and try thiese:
index=blah | where match(myField, "^$fooBarToken$$")
index=blah | where match(myField, "$fooBarToken$")
index=blah | where like(myField, "$fooBarToken$")
Also try swapping double-quotes for single-quotes. One of these should work.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Did you try using double-quotes around the token name in your search string like this:
index=blah myField="$fooBarToken$"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Ugh, it ended up being an error earlier in the search--nothing to do with the brackets. Printing out the field values like you suggested below showed it up. Thanks for your help.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
OK, well you have it now!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes, it is already enclosed in quotes. I've had to do that for tokens with special characters before, but the brackets seem to be really confusing something.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Did you try single-quotes?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes--no luck.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Announcing Modern Navigation: A New Era of Splunk User Experience
Modernize your Splunk Apps – Introducing Python 3.13 in Splunk
Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...
