Splunk Search

Help on dropdown list token

jip31
Motivator

Hi

I try to filter my table events from à dropdown list like this

Owner=$owner$

The item syntax in the dropdown lis is like REM\A-AA228339

I tried with Owner="$owner$" but it doesnt works

What is wrong please?

Labels (1)
Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Then try escaping it

REM\\A-AA228339

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

If you have backslashes in your string, you may need to escape them.

0 Karma

jip31
Motivator

Something like this?

REM"\"123467

If yes, is it possible to have aregex to do that because the item list of my dropdown list is imported automatically 

Thanks

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

No, that is not escaping, that is quoting. Are you using / or \ as they are different?

0 Karma

jip31
Motivator

I use always \

REM\A-AA228339

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Then try escaping it

REM\\A-AA228339
0 Karma
Get Updates on the Splunk Community!

Archived Metrics Now Available for APAC and EMEA realms

We’re excited to announce the launch of Archived Metrics in Splunk Infrastructure Monitoring for our customers ...

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Dashboard Challenge and Watch the .conf24 Global Broadcast!

The Splunk Community Dashboard Challenge is still happening, and it's not too late to enter for the week of ...