Dashboards & Visualizations

Drilldown: error using a string with single double-quote in the token field

Cris
Explorer

I have a form with the drilldown function but when I try to pass the token with a single double quote I obtain the error:

PARSER: Applying intentions failed Unbalanced quotes.

Example:
No problem passing the value FOO or BAR but error with the value DB"DB

How can avoid that error?

I can post the example data and the forms if is needed.

Thanks a lot.

Tags (2)
0 Karma

ayme
Splunk Employee
Splunk Employee

Before you render your results in a table in the first place, escape any of the quotes of field values which are drilldown-able

.. | rex field=mydrilldown_field mode=sed "s/\"/\\\"/g"

..that way, we can search the index with that token.

0 Karma

aholzer
Motivator

From the brief research I did, you seem to be out of luck. It looks like you have to do some regex manipulation at the index time, or transforms. See these two Q&As:

http://splunk-base.splunk.com/answers/29961/how-can-i-extract-a-quoted-field-value-that-includes-a-q...

http://splunk-base.splunk.com/answers/3231/escaping-characters-in-an-event

Good luck

aholzer
Motivator

Oh I see, your problem is that the value in the field is DB"DB, not that the name of the field/token is DB"DB.

0 Karma

Cris
Explorer

Thank you for the answer but the problem is that I select a row on my table (with drill down function) where I need detailed information and I can not change the token string by hand. Sometimes the passed field is a simple string (like FOO etc.) and sometimes the string has a double-quote character (like DB"DB)...
A workaround could be change the string at index time, for example replacing every double-quote with two single-quote, but I prefer do not change the original data.

0 Karma

aholzer
Motivator

Try using the xml predefined character name instead of actual quotes: &quot\;

Something like: DB&quot\;DB
Instead of: DB"DB

http://en.wikipedia.org/wiki/List_of_XML_and_HTML_character_entity_references

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...