topic Can you reference a token value inside a token eval tag? in Splunk Search

Can you reference a token value inside a token eval tag?

johnraftery — Wed, 17 Feb 2016 18:09:04 GMT

Hello, I have a token called range (assume it has a value of "123-456"), and I am trying to use it inside a token eval:

<eval token="start">replace($range$,"-.*","")</eval>

So start should have a value of "123". But when I run it, $start$ is not defined.
The replace works fine if I hard-code the range value like this:

<eval token="start">replace("123-456","-.*","")</eval>

Any help much appreciated!
John

aljohnson_splun — Wed, 17 Feb 2016 19:19:36 GMT

<eval token="start">replace('range',"-.*","")</eval>

aljohnson_splun — Wed, 17 Feb 2016 19:20:20 GMT

aljohnson_splun — Wed, 17 Feb 2016 19:20:51 GMT

johnraftery — Thu, 18 Feb 2016 09:21:41 GMT

Lovely, thanks very much. It also seems to work with no quotes, ie replace(range,"-.*","")

Cuyose — Tue, 26 Sep 2017 21:07:28 GMT

Odd, I can't get this to work worth anything. I am using a click.name2 value and attempting to edit it and nothing I do actually edits the token.

<eval token="parsedError">replace($click.name2$, "^[\d-{0,3}]", "")</eval>

pmelon — Tue, 07 May 2019 13:45:58 GMT

I'm struggling with this too. Code is:

<eval token="eventTime_epoch">strptime('eventTime',"%d/%m/%y %H:%M")</eval>

If I replace eventTime with 01/01/19 21:21 I get a proper epoch time. eventTime is never expanded within the tags. I am stuck.