I'm having problems when searching for the word NOT in an input Field.
When searching for the text "DO NOT" in the text field i don't get any results. Clicking on the 'View Results' link i noticed splunk converts the input into id="DO" NOT.
How can i escape the Input Properly so the NOT word goes into the field search ( id="DO NOT" ) ? Example code below:
<form>
<label>..</label>
<searchTemplate>source="source.csv" MYFIELD=$id$ | timechart max(id)</searchTemplate>
<fieldset>
<input type="text" token="id" />
</fieldset>
<row>
<chart>
<title>Chart</title>
<option name="charting.chart">line</option>
<option name="charting.nullValueMode">gaps</option>
</chart>
</row>
</form>
Splunk only interprets NOT as such when it is fully capitalized.
You can try to quote the string:
MYFIELD="$id$"
You might also consider using eval to lowercase the value:
http://www.splunk.com/base/Documentation/latest/SearchReference/CommonEvalFunctions
Alternatively, you can instruct your users to use 'not', 'Not', or something similar.
Splunk only interprets NOT as such when it is fully capitalized.
You can try to quote the string:
MYFIELD="$id$"
You might also consider using eval to lowercase the value:
http://www.splunk.com/base/Documentation/latest/SearchReference/CommonEvalFunctions
Alternatively, you can instruct your users to use 'not', 'Not', or something similar.
that works perfectly 🙂 Thanks. Would be nice to have it somewhere in the docu, i searched for it but couldn't find anything about escaping (except XML Escaping)
Try the MYFIELD="$id$" first. If that fails, then let me know.
i did not express myself clear, sorry. My Field value is from a text field.Do you know how to lower case that? I tried eval MYFIELD=lower($id$)
I added another (perhaps better) way to get Splunk to treat the value as a literal. Regarding your above question, try eval MYFIELD=lower(MYFIELD)
can you give an example? tried: eval MYFIELD=lower("DO NOT")
Thank's :). I did not know that Splunk is not case sensitive inside the text field