topic Re: How to set a token with eval? in Splunk Search

How to set a token with eval?

jamesmarlowww — Tue, 26 Apr 2016 21:39:24 GMT

I'm trying to set a token with eval. However, my logic doesn't seem to be working. I haven't been able to find a working example in the docs or from Answers, so a nudge in the right direction would be appreciated

  <input type="text" token="stuff">
 <label>test</label>
 <default>bband</default>
 <change>
    <eval token="stuff">replace($stuff$, ",", " OR ACCOUNT_NO=")</eval>
 </change>
</input>

Have also tried using ' chars instead of $

Re: How to set a token with eval?

aljohnson_splun — Tue, 26 Apr 2016 21:42:53 GMT

Did you try no chars?

Re: How to set a token with eval?

jamesmarlowww — Tue, 26 Apr 2016 21:51:33 GMT

Thanks. Have now... seems to be half working. But my replace function is only picking up the first occurance. Unlike using it in splunk search

Re: How to set a token with eval?

frobinson_splun — Tue, 26 Apr 2016 23:16:33 GMT

Hi @jamesmarloww,
I'm not sure of all of the details of the result you are trying to create with "eval" and a token. In case it helps, "eval" expressions in dashboards do use the same syntax as SPL "eval", but there are some exceptions to their behavior and usage (including the regular expression library). See:
http://docs.splunk.com/Documentation/Splunk/6.4.0/Viz/tokens#Custom_logic_for_dashboards

for notes on how dashboard "eval" differs from SPL eval:
http://docs.splunk.com/Documentation/Splunk/6.4.0/SearchReference/Eval

Also, have you seen the eval example in the Dashboard Examples App?
https://splunkbase.splunk.com/app/1603/

Hope this helps,

Re: How to set a token with eval?

jamesmarlowww — Tue, 29 Sep 2020 09:33:05 GMT

Yeah I think differences between the SPL eval and XML eval is what is causing different results.

"It is also important to note that regular expressions in dashboard eval expressions use the syntax and semantics of the JavaScript regular expression engine. This is not the same engine used for SPL eval expressions. If you are using regular expressions in search tokens, check that syntax and semantics match those for JavaScript."

Anyways thanks @frobinson_splunk and @aljohnson_splunk for your time and advice

Re: How to set a token with eval?

13yqiao — Fri, 15 Jul 2016 17:58:51 GMT

Have you tried $value$ instead of $stuff$?

Re: How to set a token with eval?

jamesmarlowww — Wed, 20 Jul 2016 02:29:05 GMT

From my comments above, it looks like I got it mostly working like this

     <eval token="stuff">replace(stuff, ",", " OR ACCOUNT_NO=")</eval>

Re: How to set a token with eval?

Raghav2384 — Wed, 20 Jul 2016 03:14:15 GMT

I have used eval previously to straighten out a user input and then normalize the data. My case was, user enters a MAC address (Since it users, could be in any of the know MAC address formats), so we assigned the entry to a token, then applied eval to format it to our comfort. This was done in the search though. Just posting it in hope that it will give you some more ideas

Thanks,
Raghav

Re: How to set a token with eval?

SwamyRaj — Thu, 22 Sep 2016 10:33:35 GMT

Hi ,

Even i am facing the related issue.

        <condition field="_raw">
        <set token="serv">$serv$</set>
        <set token="src">$row.source$</set>

       <eval token="srcEval">rtrim('src',"_txn_log")</eval> 

        <set token="uri">$row.uri$</set>
        <set token="_raw">$click.value2$</set>
       </condition>

I am trying to set token(srcEval) by using eval command..but it is not working ...Could you help ??

Re: How to set a token with eval?

jamesmarlowww — Tue, 29 Sep 2020 11:04:51 GMT

Have you tried

rtrim(src,"_txn_log")

Without the ' char?

Re: How to set a token with eval?

mikaelbje — Tue, 29 Nov 2016 14:18:01 GMT

Did you get this to work? My eval token is only replacing the first occurence too. On 6.5.1 with the following where I try to change:

index=bla OR index=foo

bla,foo

by using:

    <input type="multiselect" token="tenant_indexes" depends="$multi_tenancy$">
      <change>
        <eval token="tenant_indexes_filter">replace(replace(tenant_indexes,"index=","")," OR ",",")</eval>
      </change>
      <label>Tenant</label>
      <fieldForLabel>tenant_name</fieldForLabel>
      <fieldForValue>index</fieldForValue>
      <search>
        <query>| `get_tenants_for_user_role($env:user$)`</query>
      </search>
      <default>index=*</default>
      <delimiter> OR </delimiter>
      <choice value="index=*">All</choice>
    </input>

Re: How to set a token with eval?

dineshraj9 — Sun, 01 Apr 2018 13:34:55 GMT

Below should work -

 <eval token="stuff">replace('value', ",", " OR ACCOUNT_NO=")</eval>

Re: How to set a token with eval?

woodcock — Tue, 19 Feb 2019 05:56:58 GMT

Check out eval token here:

https://docs.splunk.com/Documentation/Splunk/latest/Viz/PanelreferenceforSimplifiedXML