Splunk App for AWS: How to pass tags token with spaces for its key in dashboard?

[sreedharmallemp]

Hi all,

We are using AWS App and the dashboard for EC2 Instances and in the Tags field where can select the key available we can pass the values available for that tag key. It works fine as long as the tag key is a single word without any spaces like below

aws-description-resource( (aws_account_id="0456789514") , (region="*") , "ec2_instances") |search tags.Name="splunk"
| stats count(id) as count by state
| eventstats sum(count) as total | where state!="running"
| nadefault count total
| eval _total_name="instances", _total_field=total

But we have some tag keys that has space like OS Type and it comes like below which doesn't work due to space.
aws-description-resource( (aws_account_id="0456789514") , (region="*") , "ec2_instances") |search tags.OS Type="windows"
| stats count(id) as count by state
| eventstats sum(count) as total | where state!="running"
| nadefault count total
| eval _total_name="instances", _total_field=total

Above search wont give any results as tags token becomes (tags.OS Type="windows") and it doesnt work due to space.
Can someone help me how to resolve this?

Thanks!
SM

[oscar84x]

Very simple suggestion, so sorry if you already tried, but have you tried wrapping the tag with the spaces in quotes?
Could you also maybe provide a sample event(s) that contain this field?

[sreedharmallemp]

hi Oscar , I have already tried manually passing the key with " " for the tag and it does works as expected. I'ts just am thinking of to have that quotations passed/appear from dashboard directly rather than manually entering them so it will be nice to have.

Thanks for your reply!