Dashboards & Visualizations

How do I remove suffix and prefix from a search for a dropdown selection in a dashboard?

askarkz
Explorer

Hi,

I have a dashboard with a dropdown selection. For some of the panel further on, I needed to add suffix and prefix to simplify the search. But then I realized that, for another panel, I needed a clean value from the dropdown selection, i.e. w/o prefix and suffix.

How can I remove the prefix and suffix in the panel below? will appreciate an answer.

Thank you!

0 Karma

woodcock
Esteemed Legend

You just need to create another token like this:

<eval token="NewTokenName">replace(replace($YourExistingToken$, "Prefix ReGex Here", null()), "Suffix RegEx Here", null())</eval>

https://docs.splunk.com/Documentation/Splunk/latest/Viz/PanelreferenceforSimplifiedXML#eval.2C_link....

askarkz
Explorer

sorry, i don't think I follow you. very new to splunk... does it need to be in its own panel? and ReGex - is the prefix itself or ReGex expression to remove prefix? appreciate your help

0 Karma

woodcock
Esteemed Legend

Read the documentation. It is pretty clear and has examples. You need to create a regular expression to match the prefix and another to match the suffix.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...