[SIDEVIEW UTILS] escaping quote in postProcess module

[guilhem]

Hello everyone,

I have run into some problem trying to escape quote into the postProcess module. When I do this:

| eval s=case("$sRange$"=="all", "segment= \"All\"", "$sRange$"=="custom", "$ss$", 1==1, "( s=$sRange$)")

and $sRange$="all", it looks like $s$ is empty, but when I do (notice the space between \"All\" and the quote before the coma):

| eval s=case("$sRange$"=="all", "segment= \"All\" ", "$sRange$"=="custom", "$ss$", 1==1, "( s=$sRange$)")

and $sRange$="all", it looks like $s$="segment=\"All\"", which is what I would expect using the first eval. I don't know if it's intended or if there is a better way to do this?

Guilhem

[guilhem · Accepted solution]

In fact, after experimentation, I was using the $s$ token inside another $value$ token inside a string, and I was using $s$ elsewhere directly, not in a string.

So basically I needed two version of this token:

| eval s=case("$sRange$"=="all", "segment=\"All\"", "$sRange$"=="custom", "$ss$", 1==1, "( s=$sRange$)")

This basic version, to be used directly inside a query, and this escaped version

| eval s_escaped=case("$sRange$"=="all", "segment=\\\"All\\\"", "$sRange$"=="custom", "$ss$", 1==1, "( s=$sRange$)")

To be used inside a $value$ token that was itself contained inside a string (" do some stuff on $value$ ")

Not sure if it's clear but I was confused in the first place because of the different way I used the $s$ token (either inside or outside a string)

[sideview]

I think the answer is just to use \" to escape the internal double-quote characters in your search. EG:

| eval s=case("$sRange$"=="all", "segment=\"All\"", "$sRange$"=="custom", "$ss$", 1==1, "( s=$sRange$)")

Indeed the way it was, it was probably throwing a language parsing error, but either way it definitely wasn't going to figure out that the internal double quotes were part of your string.

[guilhem]

Thanks for the insight. I was able to solve the problem. In fact it has nothing to do with the space or not (it just appears to reveal the problem). It was due to the fact that I need to double escape the quote in some case. Details in the answer below.

[sideview]

If you're trying to insert the value of a $foo$ token into a postProcess string, that value has double-quotes, and you're inserting it into a location where that value will need to have those double quotes escaped, then you might want to look at the 'escapeQuotes' param of the ValueSetter module which can create an appropriately escaped version for you. However because this is quite an unusual question I think there's probably some elephant-in-the-room issue where we can get you sorted at a higher level. Please add more details. 😃

[sideview]

OK. I'll definitely take a look. Can you post your XML either on your question or in pastebin?

[guilhem]

Sorry -_-, I forgot to escape the backslashes ^^, so the page just show normal quotes.

I edit it.

The answer you have given is what I would expect too (putting a space or not between the \" and the " shouldn't matter, but somehow it does, at least in splunk 4.2 with sideview 2.2.8).