<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: How to append in stringreplace Advanced XML in Dashboards &amp; Visualizations</title>
    <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-append-in-stringreplace-Advanced-XML/m-p/35621#M1576</link>
    <description>&lt;P&gt;Add a matching &lt;CODE&gt;suffix&lt;/CODE&gt; parameter to your config:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;    &amp;lt;param name="fillOnEmpty"&amp;gt;false&amp;lt;/param&amp;gt;
    &amp;lt;param name="prefix"&amp;gt;source=*\\&amp;lt;/param&amp;gt;
    &amp;lt;param name="suffix"&amp;gt;\\*&amp;lt;/param&amp;gt;
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;As you've already done, the &lt;CODE&gt;fillOnEmpty&lt;/CODE&gt; flag will prevent anything from being injected if the user has not entered anything into the text box.&lt;/P&gt;</description>
    <pubDate>Wed, 29 Jun 2011 00:04:51 GMT</pubDate>
    <dc:creator>Johnvey</dc:creator>
    <dc:date>2011-06-29T00:04:51Z</dc:date>
    <item>
      <title>How to append in stringreplace Advanced XML</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-append-in-stringreplace-Advanced-XML/m-p/35619#M1574</link>
      <description>&lt;P&gt;Hello,&lt;/P&gt;

&lt;P&gt;I am trying to modify a custom UI that uses a HiddenSearch and fields to fill its values.  For one of the fields if a user enters a value ("123" for example) we need to create the search token to look like "source=*\\ID_123\\*".  If the field is left blank than nothing is added.&lt;/P&gt;

&lt;P&gt;Using the prefix option in stringreplace I am able to get part of what is needed (source=*\\ID_123), but can not find a way to get the "\\*" appended.&lt;/P&gt;

&lt;P&gt;See code snippets below.  Any suggestions on how this can be done?&lt;/P&gt;

&lt;P&gt;Thanks in advance.&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;&amp;lt;module name="HiddenSearch" layoutPanel="mainSearchControls"&amp;gt;
  &amp;lt;param name="search"&amp;gt;index=aqua $instanceToken$ $reverseToken$&amp;lt;/param&amp;gt;

&amp;lt;module name="ExtendedFieldSearch"&amp;gt;
  &amp;lt;param name="field"&amp;gt;Instance&amp;lt;/param&amp;gt;
  &amp;lt;param name="intention"&amp;gt;
    &amp;lt;param name="name"&amp;gt;stringreplace&amp;lt;/param&amp;gt;
    &amp;lt;param name="arg"&amp;gt;
      &amp;lt;param name="instanceToken"&amp;gt;
        &amp;lt;param name="fillOnEmpty"&amp;gt;false&amp;lt;/param&amp;gt;
        &amp;lt;param name="prefix"&amp;gt;source=*\\&amp;lt;/param&amp;gt;
      &amp;lt;/param&amp;gt;
    &amp;lt;/param&amp;gt;
  &amp;lt;/param&amp;gt;
  &amp;lt;param name="replacementMap"&amp;gt;
    &amp;lt;param name="arg"&amp;gt;
      &amp;lt;param name="instanceToken"&amp;gt;
        &amp;lt;param name="value"&amp;gt;$instanceToken$&amp;lt;/param&amp;gt;
      &amp;lt;/param&amp;gt;
    &amp;lt;/param&amp;gt;
  &amp;lt;/param&amp;gt;
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Tue, 28 Jun 2011 11:38:09 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-append-in-stringreplace-Advanced-XML/m-p/35619#M1574</guid>
      <dc:creator>mjohanne</dc:creator>
      <dc:date>2011-06-28T11:38:09Z</dc:date>
    </item>
    <item>
      <title>Re: How to append in stringreplace Advanced XML</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-append-in-stringreplace-Advanced-XML/m-p/35620#M1575</link>
      <description>&lt;P&gt;If you install the Sideview Utils app, this becomes a lot easier with its TextField module. There's probably a way to do a suffix in ExtendedFieldSearch but it's not in the replacement map, and I dont think you can just put a 'suffix' into the stringreplace intention, and that would leave hardwiring it in the HiddenSearch which isnt a very good idea. &lt;/P&gt;

&lt;P&gt;Here's the equivalent config in Sideview Utils.  It's a bit easier as you see. Note that either way you almost certainly will need to backslash-escape those backslashes. &lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;&amp;lt;module name="TextField"&amp;gt;
  &amp;lt;param name="name"&amp;gt;source&amp;lt;/param&amp;gt;
  &amp;lt;param name="template"&amp;gt;$name$="*\\\\$value$\\\\*"&amp;lt;/param&amp;gt;
  &amp;lt;param name="label"&amp;gt;Source:&amp;lt;/param&amp;gt;
  ....
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;With the TextField module, you can just refer to this token (in all it's source="*\&lt;VALUE&gt;\*" glory),  within Sideview's Search module, just by $source$.  You wont need any intentions if you use both the TextField module instead of ExtendedFieldSearch, and the Search module instead of HiddenSearch. &lt;/VALUE&gt;&lt;/P&gt;

&lt;P&gt;You also may want to debug the token so that you can check that the backslash escaping is working.  You can do that just by putting an HTML module inside the TextField, like so: &lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;&amp;lt;module name="TextField"&amp;gt;
  &amp;lt;param name="name"&amp;gt;source&amp;lt;/param&amp;gt;
  &amp;lt;param name="template"&amp;gt;$name$="*\\\\$value$\\\\*"&amp;lt;/param&amp;gt;
  &amp;lt;param name="label"&amp;gt;Source:&amp;lt;/param&amp;gt;
  &amp;lt;module name="HTML"&amp;gt;
    &amp;lt;param name="html"&amp;gt;&amp;lt;![CDATA[
      Debugging: &amp;lt;br&amp;gt;
      (use this when you're doing search language in Search or PostProcess)&amp;lt;br&amp;gt;
      source = $source$ &amp;lt;br&amp;gt;
      &amp;lt;br&amp;gt;
      (use this when you're making headers for the user)&amp;lt;br&amp;gt;
      source.rawValue = $source.rawValue$  &amp;lt;br&amp;gt;

    ]]&amp;gt;&amp;lt;/param&amp;gt;
  &amp;lt;/module&amp;gt;
  ....
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Tue, 28 Jun 2011 16:07:11 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-append-in-stringreplace-Advanced-XML/m-p/35620#M1575</guid>
      <dc:creator>sideview</dc:creator>
      <dc:date>2011-06-28T16:07:11Z</dc:date>
    </item>
    <item>
      <title>Re: How to append in stringreplace Advanced XML</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-append-in-stringreplace-Advanced-XML/m-p/35621#M1576</link>
      <description>&lt;P&gt;Add a matching &lt;CODE&gt;suffix&lt;/CODE&gt; parameter to your config:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;    &amp;lt;param name="fillOnEmpty"&amp;gt;false&amp;lt;/param&amp;gt;
    &amp;lt;param name="prefix"&amp;gt;source=*\\&amp;lt;/param&amp;gt;
    &amp;lt;param name="suffix"&amp;gt;\\*&amp;lt;/param&amp;gt;
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;As you've already done, the &lt;CODE&gt;fillOnEmpty&lt;/CODE&gt; flag will prevent anything from being injected if the user has not entered anything into the text box.&lt;/P&gt;</description>
      <pubDate>Wed, 29 Jun 2011 00:04:51 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-append-in-stringreplace-Advanced-XML/m-p/35621#M1576</guid>
      <dc:creator>Johnvey</dc:creator>
      <dc:date>2011-06-29T00:04:51Z</dc:date>
    </item>
    <item>
      <title>Re: How to append in stringreplace Advanced XML</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-append-in-stringreplace-Advanced-XML/m-p/35622#M1577</link>
      <description>&lt;P&gt;Thanks, that got it working.&lt;/P&gt;</description>
      <pubDate>Fri, 01 Jul 2011 14:00:29 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-append-in-stringreplace-Advanced-XML/m-p/35622#M1577</guid>
      <dc:creator>mjohanne</dc:creator>
      <dc:date>2011-07-01T14:00:29Z</dc:date>
    </item>
    <item>
      <title>Re: How to append in stringreplace Advanced XML</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-append-in-stringreplace-Advanced-XML/m-p/35623#M1578</link>
      <description>&lt;P&gt;Thanks for the info, I will look at Sideview for use in the future.&lt;/P&gt;</description>
      <pubDate>Fri, 01 Jul 2011 14:02:53 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-append-in-stringreplace-Advanced-XML/m-p/35623#M1578</guid>
      <dc:creator>mjohanne</dc:creator>
      <dc:date>2011-07-01T14:02:53Z</dc:date>
    </item>
  </channel>
</rss>

