3rd Token handler doesn't work with 1st and 2nd token handler together?

wangkevin1029 — Mon, 23 Jan 2023 15:48:10 GMT

Hi, Splunkers,

I have the following token handler, if input "Gucid_token_with3handlers" is 2 digits number, it will return as token skillexpressionLength,

if it's not 2 digits number will return itself as token Gucid_token, which works fine.

now I want to add handler 3, if 1st 3 characters are VQ_, I want it to return itself as token Gucid_token_VQ, otherwise, it return as Gucid_token_VQ with value *

but it looks handler 3 is conflicting with handler 1.

so my question is how to define the 3rd token handler to have it work together 1st and 2nd token handlers without conflict?

the following is the input token definition with 3 token handlers.

<input type="text" token="Gucid_token_with3handlers" searchWhenChanged="true">
<label>Gucid/UUID/SID</label>
<change>
<eval token="Gucid_token"> if(match(value, "^[0-9][0-9]?$"),"", value)</eval>
<eval token="skillexpressionLength">if(match(value, "^[0-9][0-9]?$"),value, 0)</eval>
<eval token="Gucid_token_VQ">if(substr(value,1,3)=="VQ_"),value, *)</eval>
</change>
<default></default>
</input>

then I used the following search clause with $Gucid_token_VQ$

| search VQ = $Gucid_token_VQ$

then this search panel showing : search is waiting for input.

thx in advance.

Kevin

Re: 3rd Token handler doesn't work with 1st and 2nd token handler together.

ITWhisperer — Fri, 20 Jan 2023 18:45:39 GMT

You had an extra closing bracket and you need to put the * in quotes

<eval token="Gucid_token_VQ">if(substr(value,1,3)=="VQ_",value, "*")</eval>

Re: 3rd Token handler doesn't work with 1st and 2nd token handler together.

wangkevin1029 — Fri, 20 Jan 2023 19:14:38 GMT

thank you very much , ITWhisperer,

your whisper always works great.

Kevin

topic Re: 3rd Token handler doesn't work with 1st and 2nd token handler together. in Splunk Search

3rd Token handler doesn't work with 1st and 2nd token handler together?

Re: 3rd Token handler doesn't work with 1st and 2nd token handler together.

Re: 3rd Token handler doesn't work with 1st and 2nd token handler together.