topic Re: Manipulating inputs prior search in app in Splunk Search

Manipulating inputs prior search in app

carljohan — Thu, 07 Aug 2014 15:40:11 GMT

I have created an app which has a single input for MSISDN.

The user enters the MSISDN in local 10-digit format ex: 0123456789

The events in my logs are in international format ex: 999123456789

So I need to remove the leading 0 and add 999 to the input prior conducting the search.
I have no idea how to do this so all help is appreciated.

Re: Manipulating inputs prior search in app

somesoni2 — Thu, 07 Aug 2014 15:58:50 GMT

How are you using the input in your search? You can use 'ltrim' command with EVAL to trim the leading 0's and prefix '999'.

Re: Manipulating inputs prior search in app

carljohan — Thu, 07 Aug 2014 16:08:01 GMT

I have tried the following but it did not work:
msisdn="0123456789"| eval msisdn=substr(msisdn,2)|eval msisdn="999".msisdn|table _time, msisdn, sms

Re: Manipulating inputs prior search in app

aaronkorn — Thu, 07 Aug 2014 16:12:57 GMT

Give rex a shot: | rex mode=sed field=MSISDN "s/(^0)/999/g"

Re: Manipulating inputs prior search in app

somesoni2 — Thu, 07 Aug 2014 16:15:04 GMT

try something like this

index=yourindex sourcetype=yoursourcetype [|gentimes start=-1 | eval msisdn="10 digit msisdn input" | eval msisdn="999".ltrim(msisdn,"0") | fields msisdn] |table _time, msisdn, sms

Re: Manipulating inputs prior search in app

carljohan — Tue, 12 Aug 2014 13:20:20 GMT

Where in the following search query should I add the regex?

index=* event="*" msisdn="$customer_msisdn$" |table _time, msisdn, sms

Re: Manipulating inputs prior search in app

carljohan — Tue, 12 Aug 2014 13:26:45 GMT

I am not getting it to work. Can I share something which would display the outcome and help you understand why?

This is the search I am performing:

Re: Manipulating inputs prior search in app

carljohan — Tue, 12 Aug 2014 14:07:01 GMT

Here is another find of mine:

Re: Manipulating inputs prior search in app

somesoni2 — Tue, 12 Aug 2014 17:12:34 GMT

Are you using a textbox for users to enter the msisdn and that input you want to updated before using in the search OR the msisdn is there in the logs with 0763206619 format and you want to update it??

Re: Manipulating inputs prior search in app

somesoni2 — Tue, 12 Aug 2014 17:15:30 GMT

Also, can you try something like this?

Re: Manipulating inputs prior search in app

carljohan — Fri, 15 Aug 2014 09:33:01 GMT

Yes I am using a textbox. The logs are in 999763206619 format and the input is in 0763206619 format.

The query you provided works when I try it in a search field but not in my custom app with the textfield input.

Re: Manipulating inputs prior search in app

somesoni2 — Fri, 15 Aug 2014 13:17:42 GMT

When you use the query in dashboard (and I assume you'll have token defined for textbox, lets say token=msisdn), use like this, so that it'll use the single value passed in textbox)