Getting Data In

What's the best way to escape characters in a drilldown if a field value has quotes?

HeinzWaescher
Motivator

Hi,

some of my values have quotes in the string. Using the fieldlist for filtering, Splunk is automatically escaping these characters in the base search.

fieldA=this is a "test" value ---> fieldA="this is a \"test\" value"

When I try to use fieldA as token drilldown, it does not work for values with quotes because these characters are not automatically escaped. What it the best way to handle this situation?

My first approach would be to use:

| eval fieldA=replace(fieldA,"\"","")
| search fieldA="this is a test value"

Is there a better one or a more automized one?

1 Solution

niketn
Legend

@HeinzWaescher, double quotes need to be escaped within string. So, you can try setting the token like the following through eval instead of set:

    <drilldown>
      <eval token="cluster_message_token">replace($row.message$,"\"","\\\"")</eval>
    </drilldown>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn
Legend

@HeinzWaescher, double quotes need to be escaped within string. So, you can try setting the token like the following through eval instead of set:

    <drilldown>
      <eval token="cluster_message_token">replace($row.message$,"\"","\\\"")</eval>
    </drilldown>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

HeinzWaescher
Motivator

thanks, this works fine and is easier to handle than the workaround mentioned above 🙂

0 Karma

niketn
Legend

Cheers... glad this worked 🙂

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

rjthibod
Champion

Can you share more of your code? The answer probably depends on how you are using the tokens and the various token syntax options. So, seeing your code would be helpful.

0 Karma

HeinzWaescher
Motivator

The token for fieldA is set this way:

    <drilldown>
      <condition>
        <set token="cluster_message_token">$row.message$</set>
      </condition>
    </drilldown>

In a second panel it used as a filter in a later search:

base search and pipes...
| search cluster_message="$cluster_message_token$"

It is set as fieldA="this is a "test" value", so not working correctly.
I fixed it with the workaround mentioned above, but am wondering why escaping is not handled automatically here.

0 Karma
Get Updates on the Splunk Community!

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...

Dynamic Links from Alerts to IM Navigators - New in Observability Cloud

Splunk continues to improve the troubleshooting experience in Observability Cloud with this latest enhancement ...