topic Re: classic xml - token eval using replace function not working in Dashboards & Visualizations

classic xml - token eval using replace function not working

_guy — Sat, 08 Nov 2025 03:10:54 GMT

So I've been turning myself inside out trying to figure this one out and cannot...

In search this works fine, 'test' evaluates to "default"

| makeresults
| eval value = "users|default"
| eval test = replace(value, "(\w*)\|(\w*)", "\2")

Trying to make this work as a token eval however is proving difficult. I am trying to do this:
(where <set token="form.chg_focus">users|default</set> is defined elsewhere to trigger a change for the input)

<input type="text" token="chg_focus" depends="$HIDDEN$"> <change> <eval token="nav_chart_mode">replace($value$, "(\w*)\|(\w*)", "\2")</eval> </change> </input>

The above is a simplified version of the input I am trying to implement which involves multiple token sets and evals.

I figured out that I needed to double up the instances of \ in the regex expression , so for example this works (i.e. I get $nav_chart_mode$=default)

<eval token="nav_chart_mode">replace($value$, "\\w*\\|", "")</eval>

So does this

<eval token="nav_chart_mode">replace($value$, "\\w*\\|\\w*", "default")</eval>

However I cannot seem to get this to work - all I get is $nav_chart_mode$="" (i.e. blank string).

<eval token="nav_chart_mode">replace($value$, "(\\w*)\\|(\\w*)", "\2")</eval>

Using "\\2" results in $nav_chart_mode$=\2, so that isn't the answer.

I also tried using $ and $, i.e. "$\\w*$\\|$\\w*$", and no joy there - also results in $nav_chart_mode$="".

I also tried using double (( and )), also not helpful... (and not logical, but I was getting desperate 😊)

I am hoping someone out there can help me understand what I am not understanding...

Cheers

Re: classic xml - token eval using replace function not working

ITWhisperer — Sat, 08 Nov 2025 08:32:18 GMT

Different flavours of regex use different ways to reference captured values - it looks like Splunk may be using different flavours between SPL and token evals. Try this

<eval token="nav_chart_mode">replace($value$, "(\\w*)\\|(\\w*)", "$2")</eval>

Re: classic xml - token eval using replace function not working

richgalloway — Sat, 08 Nov 2025 12:42:40 GMT

You tried doubling the escape characters in the pattern, but did you try it in the replacement?

<eval token="nav_chart_mode">replace($value$, "(\\w*)\\|(\\w*)", "\\2")</eval>

Re: classic xml - token eval using replace function not working

_guy — Mon, 10 Nov 2025 13:31:37 GMT

Awesome, thank you! I felt it had to be possible with the right tweak, and you nailed it 🙏

Re: classic xml - token eval using replace function not working

_guy — Mon, 10 Nov 2025 13:33:58 GMT

Thanks for the suggestion richgalloway, but yes, I tried that and it resulted in this

nav_chart_mode="\2"