Dashboards & Visualizations

How do I remove suffix and prefix from a search for a dropdown selection in a dashboard?

askarkz
Explorer

Hi,

I have a dashboard with a dropdown selection. For some of the panel further on, I needed to add suffix and prefix to simplify the search. But then I realized that, for another panel, I needed a clean value from the dropdown selection, i.e. w/o prefix and suffix.

How can I remove the prefix and suffix in the panel below? will appreciate an answer.

Thank you!

0 Karma

woodcock
Esteemed Legend

You just need to create another token like this:

<eval token="NewTokenName">replace(replace($YourExistingToken$, "Prefix ReGex Here", null()), "Suffix RegEx Here", null())</eval>

https://docs.splunk.com/Documentation/Splunk/latest/Viz/PanelreferenceforSimplifiedXML#eval.2C_link....

askarkz
Explorer

sorry, i don't think I follow you. very new to splunk... does it need to be in its own panel? and ReGex - is the prefix itself or ReGex expression to remove prefix? appreciate your help

0 Karma

woodcock
Esteemed Legend

Read the documentation. It is pretty clear and has examples. You need to create a regular expression to match the prefix and another to match the suffix.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...