topic Re: Manipulate a Token String in a Form in Dashboards & Visualizations

Manipulate a Token String in a Form

mjosen — Thu, 13 Mar 2014 18:43:04 GMT

I would like to modify the token a user inputs in a form using rex commands so that I can insert it into the search later. For instance, if the user enters AC123,AC456 in the form field, I would want that to be plugged into the search as 'AC123','AC456'. Is there anyway to do this?

<input type="text" token="account" searchWhenChanged="false">
  <label>Account</label>
  <default>AC123,AC456</default>
</input>

Re: Manipulate a Token String in a Form

somesoni2 — Thu, 13 Mar 2014 19:44:25 GMT

You can do the manipulation within the search itself where you'll be using it. E.g. (assuming you use search filter using token like account=$account$

index=abc sourcetype=xyz [search index=abc | head 1 | eval account="'$account$'" | table account | eval account=replace(account,",","','")]...

Re: Manipulate a Token String in a Form

martin_mueller — Thu, 13 Mar 2014 23:00:54 GMT

This should be doable using an eval-based macro. For example, if you wanted to turn a token containing "error,warn" into "error OR warn" you can run this search:

index=_internal `commasToOr("error,warn")`

using this eval-based macro definition:

[commasToOr(1)]
args = token
definition = replace("$token$", ",", " OR ")
iseval = 1

Looking at the job inspector, the search that was actually executed is this:

search index=_internal error OR warn

You can apply the same strategy to adding single quotes using replace, and this should work from your form as well.