All Apps and Add-ons

Multiple Dollar signs in Data cause issues when searching

aelliott
Motivator

I have a Web Framework Dashboard that I have created that has a custom drill-down for a chart.
That drill-down sets a token for what was clicked on with it's value.
When using that value in another search, it makes the search invalid.
The value that is in the field contains multiple dollar signs and the search is thinking that it is a token.

So basically I have a token $token$ with values similar to "Item - >= $1 and < $2".
When using that in a search manager, since |token_safe is set for the $token$, the value with the two dollar signs is being counted as a token.

Since they are being counted as tokens and not values, the value is seen as null and makes all searches with that "token" not work.

I have found a workaround to replace all "$" with "*" within the javascript, but this does not seem to be good practice.

1 Solution

ineeman
Splunk Employee
Splunk Employee

This is a bug in the Web Framework which should be fixed in Splunk 6.0.1 - it causes tokens in the SearchManager to be resolved twice, which in turn causes your issue.

View solution in original post

aelliott
Motivator

I attempted that as well and it did the same thing, looks like it is a bug in the web framework per the answer i marked, thanks!

0 Karma

somesoni2
SplunkTrust
SplunkTrust

I am sorry. I actually wrote replacing "$" with "\$" (back slash dollar)

0 Karma

ineeman
Splunk Employee
Splunk Employee

This is a bug in the Web Framework which should be fixed in Splunk 6.0.1 - it causes tokens in the SearchManager to be resolved twice, which in turn causes your issue.

aelliott
Motivator

This was indeed fixed in 6.0.1
Thanks!

0 Karma

mgroves_splunk
Splunk Employee
Splunk Employee

We are targeting the end of 2013 for a release of 6.0.1, but that is just an estimate.

0 Karma

aelliott
Motivator

Is there a timeframe in which 6.0.1 will be released?

0 Karma

aelliott
Motivator

{% dropdown value="$volumeby$"|token_safe %}

{% searchmanager search=" ...$volumeby$... " |token_safe %}

Something similar to that .. now the $volumeby$ has 2 dollar signs in the values that are in the dropdown. When you select it, the searches that go off that token are invalidated because of the dollar signs. The $volumeby$ is replaced by VolumeBy="Item - >= $1 and < $2" and then splunk sees that its token safe and decides that $1 and < $ is a token so the search does not work.

0 Karma

dfoster_splunk
Splunk Employee
Splunk Employee

Not sure I fully understand your setup.

Sounds like you have something like:
{% chart selectedValue="$token$"|token_safe %}
{% searchmanager search="$token$"|token_safe %}

If this isn't correct, could you update your question with more details?

0 Karma

aelliott
Motivator

No, it's the search that fails when it sees the two dollar signs in the data, replacing it will dollar signs again would still have the same effect.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...