Splunk Search

Help on dropdown list token

jip31
Motivator

Hi

I try to filter my table events from à dropdown list like this

Owner=$owner$

The item syntax in the dropdown lis is like REM\A-AA228339

I tried with Owner="$owner$" but it doesnt works

What is wrong please?

Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Then try escaping it

REM\\A-AA228339

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

If you have backslashes in your string, you may need to escape them.

0 Karma

jip31
Motivator

Something like this?

REM"\"123467

If yes, is it possible to have aregex to do that because the item list of my dropdown list is imported automatically 

Thanks

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

No, that is not escaping, that is quoting. Are you using / or \ as they are different?

0 Karma

jip31
Motivator

I use always \

REM\A-AA228339

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Then try escaping it

REM\\A-AA228339
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Monitoring AI Agents with Splunk Observability Cloud

Let’s say I’m running a travel planning AI app in production. A user asks for three concise hotel options in ...

[Puzzles] Solve, Learn, Repeat: Tiling

This puzzle (first published here) is based on finding groups of tessellated tiles (inspired by floor tiles I ...

SOK it to Me: Top 3 Benefits of Using Splunk Operator on Kubernetes that’ll Make ...

    Thursday, July 9, 2026  |  11:00AM–12:00PM PDT Duration: 1 hour (includes Q&A) Managing can feel like a ...