topic Re: How do you remove special characters from a token? in Splunk Search

How do you remove special characters from a token?

clintla — Tue, 05 Feb 2019 14:11:11 GMT

What would be the easiest one line solution to remove special characters from a token?

I'm taking a text input (mac addresses like 00:1B:44:11:3A:B7) from the user, & 1 source type uses the exact address & another source type has no ":" in the address.

I'm using the token as the complete search item (does the search content have a imbedded variable?).

When I do things like add a token to an eval command, it doesn't work. It seems like there should be an easier way to get around this problem.

Re: How do you remove special characters from a token?

ccl0utier — Tue, 05 Feb 2019 15:02:00 GMT

Your question would benefit from an added example to make it clearer.

Re: How do you remove special characters from a token?

chrisyounger — Tue, 05 Feb 2019 18:12:08 GMT

HI @clintla

When using tokens on dashboards, you should use the token escape sequence $my_token|s$

The |s is the extra part that will add double quotes and take care of escaping for you.

Here is the relevant documentation: https://docs.splunk.com/Documentation/Splunk/6.5.0/Viz/tokens#Token_filters

I hope this is helpful

Re: How do you remove special characters from a token?

clintla — Wed, 06 Feb 2019 18:07:15 GMT

I guess at the simplest part of this is how can I remove all ":" from a mac address & pass it on to another panel?

I dont think escapes will work due to its not a quote, Not sure how to escape would work in any case scenerio since ":"'s are throughout the string.

Re: How do you remove special characters from a token?

chrisyounger — Wed, 06 Feb 2019 19:01:32 GMT

What about this: YOUR_SEARCH | eval mac_full = "$token$" | eval mac_short = mac_full | rex field=mac_short mode=sed "s/://g""

Re: How do you remove special characters from a token?

ccl0utier — Wed, 06 Feb 2019 19:19:26 GMT

You could use eval tokens:

https://docs.splunk.com/Documentation/Splunk/7.2.3/Viz/tokens#Define_token_filtering_and_formatting

For example:

<eval token="new_token">replace('mac_address_token', ":", "")</eval>

Re: How do you remove special characters from a token?

clintla — Wed, 27 Feb 2019 19:11:35 GMT

"This seems like it would work

I insert w/ stanza

<input type="text" token="WWN1" searchWhenChanged="true">
  <label>Enter WWN</label>
  <default></default>
</input>

replace($WWN1$, ":","") searchWhenChanged="true"

but 2 things are happening.
1- Splunk decides when I refresh the dashboard to re-arrange my code

replace($WWN1$, ":","") searchWhenChanged="true"

<input type="text" token="WWN1" searchWhenChanged="true">
  <label>Enter WWN</label>
  <default></default>
</input>

2- it works after I hit "save" when I put the new stanza after the input.. but if I insert another WWN
it never update, if I refresh the page, splunk inverts the code again. "