topic Re: The "replace" function does not work well in the element of EventHandler. in Splunk Search

The "replace" function does not work well in the element of EventHandler.

yutaka1005 — Thu, 28 Mar 2019 08:13:15 GMT

  <fieldset submitButton="false" autoRun="false">
    <input type="text" token="text" searchWhenChanged="true">
      <label>field1</label>
      <change>
        <eval token="arg">replace($text$,"^(..).(..)$","\1:\2")</eval>
      </change>
      <default></default>
    </input>
  </fieldset>

For example, in the above setting, if I put aa-aa in the text input, the result aa:aa should be substituted in the token arg, but only the value : is substituted.

Should I do something like escape etc?

Re: The "replace" function does not work well in the element of EventHandler.

vnravikumar — Thu, 28 Mar 2019 08:30:12 GMT

Try this

<form>
    <fieldset submitButton="false" autoRun="false">
     <input type="text" token="text" searchWhenChanged="true">
       <label>field1</label>
       <change>
         <eval token="form.arg">replace($text$,"(\w)-(\w)","\1:\2")</eval>
       </change>
       <default></default>
     </input>
       <input type="text" token="arg" searchWhenChanged="true"/>
   </fieldset>
</form>

Re: The "replace" function does not work well in the element of EventHandler.

yutaka1005 — Thu, 28 Mar 2019 09:41:57 GMT

Thank you for answer!

I can solve it by this solution.
But I can't do by below settings. It's weird...

<eval token="form.arg">replace($text$,"(\w{2})-(\w{2})","\1:\2")</eval>