Hi,
I have created an app using Django Bindings. I used the search query in Splunk template page(html)as follows:
{% searchmanager id="search1"
search="source="sourcefile.txt"| stats count(eval(searchmatch("ERROR_VALUE"))) as error"
preview=True
%}
but it doesn't take "sourcefile.txt" and "ERROR_VALUE" as it is with double quotes and shows error . Is there any way to escape these double quotes inside the search query?
Please Help...!!!
The simplest way is do use single quotes to wrap the search and double quotes to handle the source.
{% searchmanager id="search1"
search='source="sourcefile.txt"| stats count(eval(searchmatch("ERROR_VALUE"))) as error'
preview=True
%}