I have a field that contains square brackets, and I can't get my dashboard to search on it properly when it's used in an input token. It keeps telling me no results are found. The search works fine from the search bar, and the token value is being populated as I would expect in the URL (with the brackets encoded of course), so I'm guessing something is funny with the token interpolation. Is there some special way I need to handle brackets? I've tried escaping them with the backslash (multiple times), using their HTML encoding value, trying to escape with quotes...no luck.
<pre><choice value="foo[bar]">Foo Bar</choice></pre>
OK, let's go hardcore and try thiese:
index=blah | where match(myField, "^$fooBarToken$$") index=blah | where match(myField, "$fooBarToken$") index=blah | where like(myField, "$fooBarToken$")
Also try swapping double-quotes for single-quotes. One of these should work.
Ugh, it ended up being an error earlier in the search--nothing to do with the brackets. Printing out the field values like you suggested below showed it up. Thanks for your help.