Dashboards & Visualizations

How do you escape characters in a form search query?

jacubero
Explorer

I have the following query in a form:

| inputlookup input.csv | fields feature values | spath input=values | fields - values | rename {}.count AS count | rename {}.value AS value | eval reading=mvzip(count, value) | mvexpand reading | makemv reading delim="," | eval count=mvindex(reading, 0) | eval value=mvindex(reading, 1) | fields - reading | outputlookup ouput.csv

where input.csv has a column called values with this kind of data:

[{"value":"6","count":835},{"value":"7","count":794},{"value":"5","count":733},{"value":"1","count":680},{"value":"4","count":675},{"value":"2","count":668},{"value":"3","count":615}]

This query works like a charm in the Splunk Web search form, but I cannot make it work in a dashboard/form. I am using the following XML code without success:

  <search>
    <query>| inputlookup input.csv | fields feature values | spath input=values | fields - values | rename {}.count AS count | rename {}.value AS value | eval reading=mvzip(count, value) | mvexpand reading | makemv reading delim=&quot;,&quot; | eval count=mvindex(reading, 0) | eval value=mvindex(reading, 1) | fields - reading | outputlookup output.csv</query>
  </search>

Am I missing something? I suspect that there must be a problem with escaping characters but I am not fully sure.

0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

@jacubero

Can you please try this?

   <search>
     <query>| inputlookup input.csv | fields feature values | spath input=values | fields - values | rename "{}.count" AS count | rename "{}.value" AS value | eval reading=mvzip(count, value) | mvexpand reading | makemv reading delim=&quot;,&quot; | eval count=mvindex(reading, 0) | eval value=mvindex(reading, 1) | fields - reading | outputlookup output.csv</query>
   </search>

OR

  <search>
     <query><![CDATA[| inputlookup input.csv | fields feature values | spath input=values | fields - values | rename "{}.count" AS count | rename "{}.value" AS value | eval reading=mvzip(count, value) | mvexpand reading | makemv reading delim="," | eval count=mvindex(reading, 0) | eval value=mvindex(reading, 1) | fields - reading | outputlookup output.csv]]></query>
   </search>

Thanks

View solution in original post

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@jacubero

Can you please try this?

   <search>
     <query>| inputlookup input.csv | fields feature values | spath input=values | fields - values | rename "{}.count" AS count | rename "{}.value" AS value | eval reading=mvzip(count, value) | mvexpand reading | makemv reading delim=&quot;,&quot; | eval count=mvindex(reading, 0) | eval value=mvindex(reading, 1) | fields - reading | outputlookup output.csv</query>
   </search>

OR

  <search>
     <query><![CDATA[| inputlookup input.csv | fields feature values | spath input=values | fields - values | rename "{}.count" AS count | rename "{}.value" AS value | eval reading=mvzip(count, value) | mvexpand reading | makemv reading delim="," | eval count=mvindex(reading, 0) | eval value=mvindex(reading, 1) | fields - reading | outputlookup output.csv]]></query>
   </search>

Thanks

0 Karma

jacubero
Explorer

It works great! Thank you.

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

Glad to help you.

0 Karma

vishaltaneja070
Motivator

Hello @jacubero
I think the issue is with curly brackets.

try to use CDAT tags if that works for you.

As we have many ways to handle this at index time but as you are doing inputlookup so not much option available :
https://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf#Structured_Data_Header_Extractio...

https://answers.splunk.com/answers/494335/how-to-deal-with-curly-brackets-in-field-names-cre.html
0 Karma

jacubero
Explorer

I tried CDATA as follows but it doesn't work either:

  <search>
    <query><![CDATA[| inputlookup input.csv | fields feature values | spath input=values | fields - values | rename {}.count AS count | rename {}.value AS value | eval reading=mvzip(count, value) | mvexpand reading | makemv reading delim="," | eval count=mvindex(reading, 0) | eval value=mvindex(reading, 1) | fields - reading | outputlookup output.csv]]></query>
  </search>
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...