Splunk Search

How to save bracket syntax in a report

jip31
Motivator

Hi
In my XML file, I use the syntax below which works perfectly

   | search SITE=$tok_filtersite|s$ 

But I need to save it in a report but it doesn't work.
I tried with ""

      | search SITE="$tok_filtersite|s$ "

With this, I can save the report but the filter token doesn't work.
What should I do, please?

0 Karma
1 Solution

DavidHourani
Super Champion

Hi @jip31,

In your savedsearch keep the token as $tok_filtersite$ and when you call your saved search call it as follows :

...
 <query>| savedsearch "Your SavedSearch" tok_filtersite="$tok_filtersite|s$"</query>
...

You will send the escaped value directly to your saved search, no need to escape it twice.

Cheers,
David

View solution in original post

0 Karma

DavidHourani
Super Champion

Hi @jip31,

In your savedsearch keep the token as $tok_filtersite$ and when you call your saved search call it as follows :

...
 <query>| savedsearch "Your SavedSearch" tok_filtersite="$tok_filtersite|s$"</query>
...

You will send the escaped value directly to your saved search, no need to escape it twice.

Cheers,
David

0 Karma

jip31
Motivator

hi many thanks

0 Karma

jip31
Motivator

hummm
do I have to do something like this??

[| inputlookup host.csv 
    | table host] `CPU` tok_filtersite="$tok_filtersite|s$"
| where process_cpu_used_percent>80 
| bucket _time span=3m 
| lookup lookup_cmdb_fo_all.csv HOSTNAME as host output SITE 
| search SITE=$tok_filtersite|s$ 
| stats dc(host)
0 Karma

DavidHourani
Super Champion

Is this your saved search ? If so it should be like this :

 [| inputlookup host.csv 
     | table host] `CPU` tok_filtersite="$tok_filtersite$"
 | where process_cpu_used_percent>80 
 | bucket _time span=3m 
 | lookup lookup_cmdb_fo_all.csv HOSTNAME as host output SITE 
 | search SITE=$tok_filtersite$ 
 | stats dc(host)

And then when you call it from a dashboard, you call it like this :

 ...
  | savedsearch "Your SavedSearch" tok_filtersite="$tok_filtersite|s$"
 ...
0 Karma

jip31
Motivator

OK thanks...

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...