Dashboards & Visualizations

how do you pass square brackets in form inputs?

cphair
Builder

I have a field that contains square brackets, and I can't get my dashboard to search on it properly when it's used in an input token. It keeps telling me no results are found. The search works fine from the search bar, and the token value is being populated as I would expect in the URL (with the brackets encoded of course), so I'm guessing something is funny with the token interpolation. Is there some special way I need to handle brackets? I've tried escaping them with the backslash (multiple times), using their HTML encoding value, trying to escape with quotes...no luck.

Example:
<pre><choice value="foo[bar]">Foo Bar</choice></pre>

0 Karma
1 Solution

woodcock
Esteemed Legend

Did you try using double-quotes around the token name in your search string like this:

index=blah myField="$fooBarToken$"

View solution in original post

woodcock
Esteemed Legend

OK, let's go hardcore and try thiese:

index=blah | where match(myField, "^$fooBarToken$$")
index=blah | where match(myField, "$fooBarToken$")
index=blah | where like(myField, "$fooBarToken$")

Also try swapping double-quotes for single-quotes. One of these should work.

woodcock
Esteemed Legend

Did you try using double-quotes around the token name in your search string like this:

index=blah myField="$fooBarToken$"

cphair
Builder

Ugh, it ended up being an error earlier in the search--nothing to do with the brackets. Printing out the field values like you suggested below showed it up. Thanks for your help.

0 Karma

woodcock
Esteemed Legend

OK, well you have it now!

0 Karma

cphair
Builder

Yes, it is already enclosed in quotes. I've had to do that for tokens with special characters before, but the brackets seem to be really confusing something.

0 Karma

woodcock
Esteemed Legend

Did you try single-quotes?

0 Karma

cphair
Builder

Yes--no luck.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...