https://community.splunk.com/t5/Getting-Data-In/In-Dashboard-Remove-Underscore-in-token/m-p/710741#M117388 <P>Thank you so much for the response and yes it worked.</P> Wed, 05 Feb 2025 13:12:37 GMT Splunkmm 2025-02-05T13:12:37Z https://community.splunk.com/t5/Getting-Data-In/In-Dashboard-Remove-Underscore-in-token/m-p/710737#M117386 <P>Hi, I have a token as below in my dashboard,<BR /><BR />&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;set token="mySource"&gt;replace($numSuffix$,"_","")&lt;/set&gt;<BR /><BR />and I have another token utilising the above,<BR /><BR />&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&lt;set token="source"&gt;$indexg$ connection $mySource"&lt;/set&gt;<BR /><BR />In Query I have,<BR />&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&lt;search&gt;</P><P>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&lt;query&gt;$source$ | timechart count by host &lt;/query&gt;<BR />&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&lt;/search&gt;<BR /><BR />Unfortunately this is not working, In splunk section query, its not evaluating.<BR /><BR />Its reflecting as,<BR /><BR />&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;index=xer&nbsp;connection&nbsp;replace(_45t66,"_","") | timechart count by host<BR /><BR />I tried with&nbsp;<BR />&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&lt;set token="mySource"&gt;replace($numSuffix|s$,"_","")&lt;/set&gt;<BR />But its of no use.<BR /><BR />Can someone help me with this?&nbsp;<BR /><BR />Thanks.</P> Wed, 05 Feb 2025 12:55:21 GMT https://community.splunk.com/t5/Getting-Data-In/In-Dashboard-Remove-Underscore-in-token/m-p/710737#M117386 Splunkmm 2025-02-05T12:55:21Z https://community.splunk.com/t5/Getting-Data-In/In-Dashboard-Remove-Underscore-in-token/m-p/710740#M117387 <P>Try using&nbsp;eval rather than set</P><LI-CODE lang="markup">&lt;eval token="mySource"&gt;replace($numSuffix$,"_","")&lt;/eval&gt;</LI-CODE> Wed, 05 Feb 2025 13:04:06 GMT https://community.splunk.com/t5/Getting-Data-In/In-Dashboard-Remove-Underscore-in-token/m-p/710740#M117387 ITWhisperer 2025-02-05T13:04:06Z https://community.splunk.com/t5/Getting-Data-In/In-Dashboard-Remove-Underscore-in-token/m-p/710741#M117388 <P>Thank you so much for the response and yes it worked.</P> Wed, 05 Feb 2025 13:12:37 GMT https://community.splunk.com/t5/Getting-Data-In/In-Dashboard-Remove-Underscore-in-token/m-p/710741#M117388 Splunkmm 2025-02-05T13:12:37Z