How to save bracket syntax in a report

[jip31]

Hi
In my XML file, I use the syntax below which works perfectly

   | search SITE=$tok_filtersite|s$ 

But I need to save it in a report but it doesn't work.
I tried with ""

      | search SITE="$tok_filtersite|s$ "

With this, I can save the report but the filter token doesn't work.
What should I do, please?

[DavidHourani · Accepted solution]

Hi @jip31,

In your savedsearch keep the token as $tok_filtersite$ and when you call your saved search call it as follows :

...
 <query>| savedsearch "Your SavedSearch" tok_filtersite="$tok_filtersite|s$"</query>
...

You will send the escaped value directly to your saved search, no need to escape it twice.

Cheers,
David

[jip31]

hi many thanks

[jip31]

hummm
do I have to do something like this??

[| inputlookup host.csv 
    | table host] `CPU` tok_filtersite="$tok_filtersite|s$"
| where process_cpu_used_percent>80 
| bucket _time span=3m 
| lookup lookup_cmdb_fo_all.csv HOSTNAME as host output SITE 
| search SITE=$tok_filtersite|s$ 
| stats dc(host)

[DavidHourani]

Is this your saved search ? If so it should be like this :

 [| inputlookup host.csv 
     | table host] `CPU` tok_filtersite="$tok_filtersite$"
 | where process_cpu_used_percent>80 
 | bucket _time span=3m 
 | lookup lookup_cmdb_fo_all.csv HOSTNAME as host output SITE 
 | search SITE=$tok_filtersite$ 
 | stats dc(host)

And then when you call it from a dashboard, you call it like this :

 ...
  | savedsearch "Your SavedSearch" tok_filtersite="$tok_filtersite|s$"
 ...

[jip31]

OK thanks...