Dashboards & Visualizations

How to use escape characters in an input tag in an XML dashboard?

HattrickNZ
Motivator

how do I escape the " (double quote) character in the below code?

<input type="dropdown" token="short_long_view2">
  <label>Views:             e.g. long -> last 30 days, short -> yesterday           </label>
  <choice value="| strcat subrackNo "-" SlotNo "-" boardType fields | timechart span=1h">>short</choice>
  <!-- <choice value="earliest=-30d@d | strcat subrackNo "-" SlotNo "-" boardType fields | timechart span=1d">long</choice> --> 
  <choice value="earliest=-30d@d | strcat subrackNo "-" SlotNo "-" boardType fields | timechart span=1d">long</choice>

  <default>short</default>
</input>

The line that is troubling me is
&lt;choice value="| strcat subrackNo "-" SlotNo "-" boardType fields | timechart span=1h"&gt;&gt;short&lt;/choice&gt;

Is there away of escaping the " (double quote) or should I just write something like?
eval fields=subrackNo. "+" .SlotNo. "+" .boardType but this will present the same problem with the "(double quote)

Any ideas? or is my approach very bad?

0 Karma
1 Solution

dineshraj9
Builder

I see there are 2 ">" symbols before short. Is that the problem?

View solution in original post

0 Karma

acharlieh
Influencer

What if, instead of carrying so much of your search along in your selector, you passed simpler values, and just interpreted them in your search? So your xml would then be like (note that default takes the default value, not the display):

<input type="dropdown" token="short_long_view">
    <label>Views:              e.g. long -> last 30 days, short -> yesterday             </label>
    <choice value="s">short</choice>
    <choice value="l">long</choice>
    <default>s</default>
</input>

You could encode all of the corresponding values in your search using subsearches something like:

EXISTING BASE SEARCH [noop | stats count | eval earliest=case("$short_long_view$"=="s","-d@d","$short_long_view$"=="l","-30d@d") | return earliest]
| strcat subrackNo "-" SlotNo "-" boardType fields
| timechart [noop | stats count | eval span=case("$short_long_view$"=="s","1h","$short_long_view$"=="1d") | return span] EXISTING REMAINDER

Now, if you had a lookup (appropriate permissions required of course) with at least 3 columns, key (values: s, l) , earliest (values "-d@d", "-30d@d"), span (values "1h","1d"). For this example, we'll call the lookup view:

EXISTING BASE SEARCH [inputlookup view | where key="$short_long_view$" | return earliest]
| strcat subrackNo "-" SlotNo "-" boardType fields
| timechart [inputlookup view | where key="$short_long_view$" | return span]

Add a column of display to this lookup, and you could power your dropdown too!

<input type="dropdown" token="short_long_view">
     <label>Views:              e.g. long -> last 30 days, short -> yesterday             </label>
     <populatingSearch fieldForLabel="display" fieldForValue="key">| inputlookup view</populatingSearch>
     <default>s</default>
 </input>
0 Karma

HattrickNZ
Motivator

good to know that these methods exist but might be a bit over complex for me at this stage.

0 Karma

dineshraj9
Builder

I see there are 2 ">" symbols before short. Is that the problem?

0 Karma

HattrickNZ
Motivator

tks, good spot.

0 Karma

HattrickNZ
Motivator

i tried it like this, but the formatting did not work as well

&lt;choice value="| strcat subrackNo '-' SlotNo '-' boardType fields | timechart span=1h"&gt;short&lt;/choice&gt;

but this eventuall done it, using single quote and then double quotes inside that

&lt;choice value='| strcat subrackNo "-" SlotNo "-" boardType fields | timechart span=1h'&gt;short&lt;/choice&gt;
0 Karma
Get Updates on the Splunk Community!

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...

New! Splunk Observability Search Enhancements for Splunk APM Services/Traces and ...

Regardless of where you are in Splunk Observability, you can search for relevant APM targets including service ...

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...