What's the best way to escape characters in a drilldown if a field value has quotes?

[HeinzWaescher]

Hi,

some of my values have quotes in the string. Using the fieldlist for filtering, Splunk is automatically escaping these characters in the base search.

fieldA=this is a "test" value ---> fieldA="this is a \"test\" value"

When I try to use fieldA as token drilldown, it does not work for values with quotes because these characters are not automatically escaped. What it the best way to handle this situation?

My first approach would be to use:

| eval fieldA=replace(fieldA,"\"","")
| search fieldA="this is a test value"

Is there a better one or a more automized one?

[niketn · Accepted solution]

@HeinzWaescher, double quotes need to be escaped within string. So, you can try setting the token like the following through eval instead of set:

    <drilldown>
      <eval token="cluster_message_token">replace($row.message$,"\"","\\\"")</eval>
    </drilldown>

[HeinzWaescher]

thanks, this works fine and is easier to handle than the workaround mentioned above 🙂

[niketn]

Cheers... glad this worked 🙂

[rjthibod]

Can you share more of your code? The answer probably depends on how you are using the tokens and the various token syntax options. So, seeing your code would be helpful.

[HeinzWaescher]

The token for fieldA is set this way:

    <drilldown>
      <condition>
        <set token="cluster_message_token">$row.message$</set>
      </condition>
    </drilldown>

In a second panel it used as a filter in a later search:

base search and pipes...
| search cluster_message="$cluster_message_token$"

It is set as fieldA="this is a "test" value", so not working correctly.
I fixed it with the workaround mentioned above, but am wondering why escaping is not handled automatically here.