Search query in block manager of Splunk Template (html ) does accept double quotes (Django Bindings)

[harshal_chakran]

Hi,

I have created an app using Django Bindings. I used the search query in Splunk template page(html)as follows:

{% searchmanager id="search1"
search="source="sourcefile.txt"| stats count(eval(searchmatch("ERROR_VALUE"))) as error"
preview=True
%}

but it doesn't take "sourcefile.txt" and "ERROR_VALUE" as it is with double quotes and shows error . Is there any way to escape these double quotes inside the search query?

Please Help...!!!

[mgroves_splunk]

The simplest way is do use single quotes to wrap the search and double quotes to handle the source.

{% searchmanager id="search1"
search='source="sourcefile.txt"| stats count(eval(searchmatch("ERROR_VALUE"))) as error'
preview=True
%}