https://community.splunk.com/t5/Splunk-Search/How-to-modify-a-dashboard-input-token-before-passing-to-a-search/m-p/659396#M227671 <P>Use a change stanza in the input, e.g.</P><LI-CODE lang="markup">&lt;input type="text" token="pre_domain"&gt; ... &lt;change&gt; &lt;eval token="actual_domain"&gt;replace($pre_domain$,"\\[\\.\\]",".")&lt;/eval&gt; &lt;/change&gt; &lt;/input&gt;</LI-CODE> Tue, 03 Oct 2023 05:20:07 GMT bowesmana 2023-10-03T05:20:07Z https://community.splunk.com/t5/Splunk-Search/How-to-modify-a-dashboard-input-token-before-passing-to-a-search/m-p/659336#M227664 <P>Is it possible to modify the value of a token obtained from a dashboard input prior to it being used in a panel? In the scenario that I have&nbsp;a domain value is input to have various searches executed on it. Sometimes the domain is provided to the users in a "sanitized" format to avoid clicking of links. The "." is replaced with "[.]". I want to give the users the option of inputting domains in either format, sanitized or not, and having the token value rewritten to remove the square brackets, something akin to | replace "[.]" WITH "." IN $domain$ The dashboard was created in the Classic format. I have been unable to figure out how I might modify the dashboard source to eval or modify the value into the consistent formatting. One of the things I tried was to add an &lt;eval&gt; tag in the source to evaluate the token into a new token value and leverage a replace command to modify it in the process but got a message stating "Invalid child="eval" is not allowed in node="dashboard"" So if an &lt;eval&gt; tag is the solution I am not sure where to put it. Does anyone have insight on how I might achieve this token modification cleanly?</P> Mon, 02 Oct 2023 20:55:47 GMT https://community.splunk.com/t5/Splunk-Search/How-to-modify-a-dashboard-input-token-before-passing-to-a-search/m-p/659336#M227664 Geep 2023-10-02T20:55:47Z https://community.splunk.com/t5/Splunk-Search/How-to-modify-a-dashboard-input-token-before-passing-to-a-search/m-p/659396#M227671 <P>Use a change stanza in the input, e.g.</P><LI-CODE lang="markup">&lt;input type="text" token="pre_domain"&gt; ... &lt;change&gt; &lt;eval token="actual_domain"&gt;replace($pre_domain$,"\\[\\.\\]",".")&lt;/eval&gt; &lt;/change&gt; &lt;/input&gt;</LI-CODE> Tue, 03 Oct 2023 05:20:07 GMT https://community.splunk.com/t5/Splunk-Search/How-to-modify-a-dashboard-input-token-before-passing-to-a-search/m-p/659396#M227671 bowesmana 2023-10-03T05:20:07Z https://community.splunk.com/t5/Splunk-Search/How-to-modify-a-dashboard-input-token-before-passing-to-a-search/m-p/659453#M227692 <P>Thank you for this answer. It is perfect. I had a lot of the right code, I just did not know how to use the &lt;change&gt; tag correctly. It works exactly as I envisioned.</P> Tue, 03 Oct 2023 14:56:02 GMT https://community.splunk.com/t5/Splunk-Search/How-to-modify-a-dashboard-input-token-before-passing-to-a-search/m-p/659453#M227692 Geep 2023-10-03T14:56:02Z