Splunk Search

Search query in block manager of Splunk Template (html ) does accept double quotes (Django Bindings)

harshal_chakran
Builder

Hi,

I have created an app using Django Bindings. I used the search query in Splunk template page(html)as follows:

{% searchmanager id="search1"
search="source="sourcefile.txt"| stats count(eval(searchmatch("ERROR_VALUE"))) as error"
preview=True
%}

but it doesn't take "sourcefile.txt" and "ERROR_VALUE" as it is with double quotes and shows error . Is there any way to escape these double quotes inside the search query?

Please Help...!!!

0 Karma

mgroves_splunk
Splunk Employee
Splunk Employee

The simplest way is do use single quotes to wrap the search and double quotes to handle the source.

{% searchmanager id="search1"
search='source="sourcefile.txt"| stats count(eval(searchmatch("ERROR_VALUE"))) as error'
preview=True
%}

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...