Escaping input of fieldset text to allow search for word 'not'

Question

I'm having problems when searching for the word NOT in an input Field.

When searching for the text "DO NOT" in the text field i don't get any results. Clicking on the 'View Results' link i noticed splunk converts the input into id="DO" NOT.

How can i escape the Input Properly so the NOT word goes into the field search ( id="DO NOT" ) ? Example code below:

<form>
  <label>..</label>
  <searchTemplate>source="source.csv" MYFIELD=$id$ | timechart max(id)</searchTemplate>

  <fieldset>
    <input type="text" token="id" />
  </fieldset>

  <row>
    <chart>
      <title>Chart</title>
      <option name="charting.chart">line</option>
      <option name="charting.nullValueMode">gaps</option>
    </chart>
  </row>

</form>

Accepted Answer

2

Splunk only interprets NOT as such when it is fully capitalized.

You can try to quote the string:

MYFIELD="$id$"

You might also consider using eval to lowercase the value:

http://www.splunk.com/base/Documentation/latest/SearchReference/CommonEvalFunctions

Alternatively, you can instruct your users to use 'not', 'Not', or something similar.

link

answered 07 Feb '11, 15:32

araitz ♦
7.9k●3●9●25
accept rate: 45%

edited 07 Feb '11, 16:34

Thank's :). I did not know that Splunk is not case sensitive inside the text field

(07 Feb '11, 15:49) martind

can you give an example? tried: eval MYFIELD=lower("DO NOT")

(07 Feb '11, 16:04) martind

I added another (perhaps better) way to get Splunk to treat the value as a literal. Regarding your above question, try eval MYFIELD=lower(MYFIELD)

(07 Feb '11, 16:36) araitz ♦

i did not express myself clear, sorry. My Field value is from a text field.Do you know how to lower case that? I tried eval MYFIELD=lower($id$)

(07 Feb '11, 17:13) martind

Try the MYFIELD="$id$" first. If that fails, then let me know.

(07 Feb '11, 17:26) araitz ♦

that works perfectly :) Thanks. Would be nice to have it somewhere in the docu, i searched for it but couldn't find anything about escaping (except XML Escaping)

(08 Feb '11, 07:28) martind

showing 5 of 6 show 1 more comments ▼

Escaping input of fieldset text to allow search for word 'not'

Follow this question

Splunk Resources

Related questions