topic Re: Help) spl query in Splunk Search

Help) spl query

tkdguq0110 — Thu, 10 Dec 2020 07:57:06 GMT

Hey guys. I'm a beginner of Splunk
I have a one question.
I get a input value

but value has a space. so I want to remove it

here's my code

<input type="text" token="field55"> // field55 is 'temp token'

<lable>test </lable>

<change>

<eval token="field5"> trim($value$)</eval> // field5 is 'real token'

</change>

</input>

.....

<query>

index=mail mail_sender= "$field5$"
| table mail_sender

</query>

if I input like 'test123 ' the result value is 'test123' (no spaces)
how can I do that??
So sorry hard to read
please help me out!!

Re: Help) spl query

renjith_nair — Thu, 10 Dec 2020 12:10:02 GMT

Isn't it possible to trim it in the search?

<form> <label>Text Space</label> <fieldset submitButton="false"> <input type="text" token="input"> <label>Input</label> </input> </fieldset> <row> <panel> <table> <search> <query>|makeresults|eval acutal_text="$input$"|eval actal_length=len("$input$")|eval trimmed_text=trim(acutal_text)|eval trimmed_length=len(trimmed_text)</query> <earliest>-15m</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> </table> </panel> </row> </form>

Re: Help) spl query

tkdguq0110 — Thu, 10 Dec 2020 14:18:59 GMT

Thank you for you answer. renjith_nair

If I input index field, Is it possible to use both Index and makeresults ?

Re: Help) spl query

renjith_nair — Thu, 10 Dec 2020 22:53:23 GMT

@tkdguq0110 , that's just a run anywhere example with dummy data. So you can replace makeresults with your original search

Re: Help) spl query

Pbarboza — Mon, 21 Dec 2020 16:27:23 GMT

I have some files uploaded onto my splunk, but when I used spl like this (index=web sourcetype=access* status=200 product_name=* | table JSESSIONID,price,product_name), for example, I do not get any results.

What am I doing wrong?

My email is barbozaprince@gmail.com