Drill down to a link with regex generated field

[armanih]

Hi All, 
I have made a dashboard which accept input(url).
I have applied regex to the url to extract only http/https
Then i need to visit various sites to view the domain authenticity. I am not abe to use the generated token as a token.

So the query i have is

| table url
| rex field=url "^(?<new_url>http.*$)"
| eval virustotal="https://www.virustotal.com/gui/search/$new_url$"
| table virustotal

But it is not working. Can someone please help me to understand, how to get the generated 'new_url" as a string to eval command

[armanih]

Thanks @richgalloway and @thambisetty .

The solution works when I use the query with index, source type and match with live events.  
But when i take the input as a token , table is empty in the dashboard panel.

Not sure if i am something wrong. 

[richgalloway]

Please share the relevant dashboard code.

[thambisetty]

you need to enclose input field name in $$.

for example, to use input url you should specify $url$.

example search 

<search>
index=_internal source=*splunkd.log | stats count by $field_tok$
</search>

[richgalloway]

Extracted fields are not tokens.  Use concatenation to add a field to a string.

| fields url
| rex field=url "^(?<new_url>http.*$)"
| eval virustotal="https://www.virustotal.com/gui/search/" . new_url
| table virustotal

[thambisetty]

| table url
| rex field=url "^(?<new_url>http.*$)"
| eval virustotal="https://www.virustotal.com/gui/search/"+new_url
| table virustotal