How do you change the token value before a search?

[damucka]

Hello,

In my dashboard, I am using the custom drilldown where I want to pass a filename to a search. For Windows, it seems I have to replace the single backslash with a double backslash in order for the search to work.

Now, I would like to change the value of my token before search. The original drilldown search with single backslash in the file path was:

    * source="$row.Tracefile$"

I wanted to replace it with something like this:

    * source= search[|eval Tracefile="$row.Tracefile$" | rex mode=sed field=Tracefile "s/(\\\)/\1\1/g"]

But it does not work.

Is there any simple way to replace the \ with \ in the $row.Tracefile$ before using it in the Drilldown search?

Kind Regards,
Kamil

[martin_mueller · Accepted solution]

Have you tried source=$row.Tracefile|s$ to let Splunk escape some values and wrap the result in quotes? Not sure if it handles backslashes, but worth a try.

If that doesn't work you can use <eval token="escaped_tracefile">escape logic here</eval> in your drilldown instead of <set ...>.