How can I remove the spaces from a token value in Simple XML?

[dougsc]

I am building a form where I want to use drilldown to allow users to be routed to another page. The final part of the URL is an anchor to take them to the appropriate part of the page.

I have been trying to use eval to remove the spaces from the clicked value, but it seem to have no effect.

This code properly sets the anchor token value to the row.Exception value. However the values in the Exception field have spaces in them and the anchor portion of the URL needs to have no spaces. The link takes you to the correct page, but not to the anchor point.

            <drilldown>
              <condition field="Help">
                <set token="anchor">$row.Exception$</set>
                <link target="_blank">https://MyURL-$anchor$</link>
              </condition>
            </drilldown>

I have tried using eval with both replace and rtrim to remove the spaces, but as far as I can tell the eval is doing nothing and the token is not being set. I have tried using ' instead of $ or leaving it off entirely in the eval line but it seems to make no difference.

        <drilldown>
          <condition field="Help">
            <eval token="anchor">rtrim($row.Exception$)</eval>
            <link target="_blank">https://MyURL-$anchor$</link>
          </condition>
        </drilldown>

I can modify my search to remove the space in the Exception field but would prefer not to if I can remove them behind the XML.

[jeffland]

The issue is probably not your eval with "anchor". Within a <drilldown>, you can't use a token you just set unfortunately, so anything like this will not work:

<drilldown>
  <set token="a">ipsum</set>
  <set token="b">lorem $a$</set>
</drilldown>

The method frobinson mentioned (setting the value on completion of the search) should work however.

[dougsc]

If I'm understanding you right does that mean that in my eval here I'm trying to use the token row.Exception which was just set and that's why it doesn't work?

             <drilldown>
               <condition field="Help">
                 <eval token="anchor">rtrim($row.Exception$)</eval>
                 <link target="_blank">https://MyURL-$anchor$</link>
               </condition>
             </drilldown>

In frobinson's example, will the token created by his eval have a different value depending on the row clicked on when the user is drilling down?

I worked around this issue entirely by adding a new field with the spaces removed in the base search, then in the XML using fields to hide that field. That allows me to reference the no spaces value for a token, but keeps the display to the user clean.

    <panel>
      <table>
        <title>Test entry</title>
        <search>
          <query>MySearch | eval nospaces=replace(Exception,"\ ","") ]</query>
          <earliest>@d</earliest>
          <latest>now</latest>
        </search>
        <fields>field1, field2, Exception, Help</fields>
        <option name="wrap">true</option>
        <option name="rowNumbers">false</option>
        <option name="drilldown">cell</option>
        <option name="dataOverlayMode">none</option>
        <option name="count">10</option>
        <drilldown>
          <condition field="Help">
            <set token="anchor">$row.nospaces$</set>
            <link target="_blank">MyURL-$anchor$</link>
          </condition>
          </drilldown>
      </table>
    </panel>

[frobinson_splun]

Hi @dougsc,
There might be a combination of factors here. I just tested using "eval" and the "trim" (note, not "ltrim" or "rtrim" but "trim" to make sure leading and trailing spaces are removed) function to remove spaces from a token value prior to setting it as a query string parameter. This worked as expected. When I typed in a value with many leading spaces, " hello" (for example), the query string parameter was trimmed and the URL was

https://answers.splunk.com/search.html?q=hello

Here's the form source code I used.

<form>
  <label>my_test_form</label>
  <fieldset submitButton="false">
    <input type="text" token="field1">
      <label>Sourcetype</label>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>index=_internal | stats count</query>
          <earliest>0</earliest>
          <latest></latest>
          <done>
            <eval token="result">trim($field1$)</eval>
          </done>
        </search>
        <drilldown>
          <link>
            http://answers.splunk.com/search.html?q=$result$
          </link>
        </drilldown>
      </table>
    </panel>
  </row>
</form>

You might also consider using a prefix and suffix to make sure that the full URL is constructed properly. See http://docs.splunk.com/Documentation/Splunk/6.5.0/Viz/tokens#Combine_literal_values_with_token_value... for more details.

Hope this helps get you closer to fixing the issue!

[frobinson_splun]

Another option is to use the "replace" eval function on the token value, as in replace($field1$, " " , ""). This replaces all instances of a space character (" ") with no space (""). In my source code, it is working as expected to remove spaces inside the token value..