Dashboards & Visualizations

How to use escape characters in an input tag in an XML dashboard?

HattrickNZ
Motivator

how do I escape the " (double quote) character in the below code?

<input type="dropdown" token="short_long_view2">
  <label>Views:             e.g. long -> last 30 days, short -> yesterday           </label>
  <choice value="| strcat subrackNo "-" SlotNo "-" boardType fields | timechart span=1h">>short</choice>
  <!-- <choice value="earliest=-30d@d | strcat subrackNo "-" SlotNo "-" boardType fields | timechart span=1d">long</choice> --> 
  <choice value="earliest=-30d@d | strcat subrackNo "-" SlotNo "-" boardType fields | timechart span=1d">long</choice>

  <default>short</default>
</input>

The line that is troubling me is
&lt;choice value="| strcat subrackNo "-" SlotNo "-" boardType fields | timechart span=1h"&gt;&gt;short&lt;/choice&gt;

Is there away of escaping the " (double quote) or should I just write something like?
eval fields=subrackNo. "+" .SlotNo. "+" .boardType but this will present the same problem with the "(double quote)

Any ideas? or is my approach very bad?

0 Karma
1 Solution

dineshraj9
Builder

I see there are 2 ">" symbols before short. Is that the problem?

View solution in original post

0 Karma

acharlieh
Influencer

What if, instead of carrying so much of your search along in your selector, you passed simpler values, and just interpreted them in your search? So your xml would then be like (note that default takes the default value, not the display):

<input type="dropdown" token="short_long_view">
    <label>Views:              e.g. long -> last 30 days, short -> yesterday             </label>
    <choice value="s">short</choice>
    <choice value="l">long</choice>
    <default>s</default>
</input>

You could encode all of the corresponding values in your search using subsearches something like:

EXISTING BASE SEARCH [noop | stats count | eval earliest=case("$short_long_view$"=="s","-d@d","$short_long_view$"=="l","-30d@d") | return earliest]
| strcat subrackNo "-" SlotNo "-" boardType fields
| timechart [noop | stats count | eval span=case("$short_long_view$"=="s","1h","$short_long_view$"=="1d") | return span] EXISTING REMAINDER

Now, if you had a lookup (appropriate permissions required of course) with at least 3 columns, key (values: s, l) , earliest (values "-d@d", "-30d@d"), span (values "1h","1d"). For this example, we'll call the lookup view:

EXISTING BASE SEARCH [inputlookup view | where key="$short_long_view$" | return earliest]
| strcat subrackNo "-" SlotNo "-" boardType fields
| timechart [inputlookup view | where key="$short_long_view$" | return span]

Add a column of display to this lookup, and you could power your dropdown too!

<input type="dropdown" token="short_long_view">
     <label>Views:              e.g. long -> last 30 days, short -> yesterday             </label>
     <populatingSearch fieldForLabel="display" fieldForValue="key">| inputlookup view</populatingSearch>
     <default>s</default>
 </input>
0 Karma

HattrickNZ
Motivator

good to know that these methods exist but might be a bit over complex for me at this stage.

0 Karma

dineshraj9
Builder

I see there are 2 ">" symbols before short. Is that the problem?

0 Karma

HattrickNZ
Motivator

tks, good spot.

0 Karma

HattrickNZ
Motivator

i tried it like this, but the formatting did not work as well

&lt;choice value="| strcat subrackNo '-' SlotNo '-' boardType fields | timechart span=1h"&gt;short&lt;/choice&gt;

but this eventuall done it, using single quote and then double quotes inside that

&lt;choice value='| strcat subrackNo "-" SlotNo "-" boardType fields | timechart span=1h'&gt;short&lt;/choice&gt;
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...