Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

How to use value from a drop down that contains reserved characters in a search?

$
0
0
I have a table that shows instances of errors from the event log over time by host. I use a drop down that searches the event log data for Type="Error" | top limit=20 Message to populate $ErrorMessage$ with the value in the Message column. Then I have a table that uses $ErrorMessage$ and does this search: Type="Error" Message ="$ErrorMessage$" | eval host=upper(host) | timechart count by host The table and the drop down both default to 24 hour periods. It works, except when the Message contains reserved characters, like [ or ]. Then I don't get any matches, even though results show in the drop down. Do I need to escape characters in $ErrorMessage$ when I do my search for the timechart? If so, how do I do that without knowing what characters will show up or how many?

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>