Splunk Search

Escaping special characters in text input

willadams
Contributor

I have a very basic dashboard that requires my users to put in text inputs.  These inputs are then outputted to a CSV file that can be referenced.  The basics of it are

<input type="text" token="user">
        <label>user</label>
      </input>
      <input type="text" token="hostname">
        <label>Host Name</label>
</input>
 <input type="text" token="switch">
        <label>Switchingcommand</label>
</input>

 

I have my form being submitted via a submit button at the top of the form that takes this information and outputs this to a csv file with an append

<search>
    <query>
          | makeresults
          | eval user="$user$"
          | eval hostname="$hostname$"
          | eval switch="$switch$"
          | outputlookup tracking.csv append=true
        </query>
</search>

 

The above works within the dashboard provided that there are no special characters.  Due to the nature of the value for "switch" above, it can contain a long string with various escape characters.  For example a string entered could be almost any special characters (for example it could contain "regex" or "#" or "=" or "$" or "[word]" etc. etc. etc.

 

I have tried modifying my search query as follows (adding in |s$) after the eval for switch

<search>
    <query>
          | makeresults
          | eval user="$user$"
          | eval hostname="$hostname$"
          | eval switch="$switch$"|s$
          | outputlookup tracking.csv append=true
        </query>
</search>

 

however this doesn't appear to work and the input silently fails.  Have I used |s$ in the correct place or is this not possible?

 

 

Labels (2)
0 Karma

ITWhisperer
Ultra Champion

Try

| eval switch="$switch|s$"
0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!