Splunk Search

Help on dropdown list token

jip31
Motivator

Hi

I try to filter my table events from à dropdown list like this

Owner=$owner$

The item syntax in the dropdown lis is like REM\A-AA228339

I tried with Owner="$owner$" but it doesnt works

What is wrong please?

Labels (1)
Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Then try escaping it

REM\\A-AA228339

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

If you have backslashes in your string, you may need to escape them.

0 Karma

jip31
Motivator

Something like this?

REM"\"123467

If yes, is it possible to have aregex to do that because the item list of my dropdown list is imported automatically 

Thanks

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

No, that is not escaping, that is quoting. Are you using / or \ as they are different?

0 Karma

jip31
Motivator

I use always \

REM\A-AA228339

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Then try escaping it

REM\\A-AA228339
0 Karma
Get Updates on the Splunk Community!

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...