Solved: How to add formatting to text input?

DesertSocBum · ‎03-16-2023

I cant seem to find a efficient way to do this. I have text box where a user first and last name is entered and depending on the search the token will be used but the text box is "first last" and I need to transform it to be either: first.last OR first-last.

Please help as everything I have tried does not work.

yeahnah · ‎03-16-2023

Hi @DesertSocBum

Here's an example to create manipulate and modify the input token value using eval statements.

<form version="1.1" theme="light">
  <label>Data Dump</label>
  <description>Unified Tables of Index's to pull multiple events surround a user.</description>
  <fieldset submitButton="true">
    <input type="time" token="field1">
      <label>Time Picker</label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
    <input type="text" token="name_token">
      <label>Enter Users First and Last Name</label>
      <change>
        <set token="names">$value$</set>
        <eval token="normalise_names">if(isnotnull('value'), lower(replace('value', "\\s+", ".")), null())</eval>
        <eval token="name_array">if('normalise_names'!="", split('normalise_names', "."), null())</eval>
        <eval token="name_count">mvcount(name_array)</eval>
        <eval token="first">mvindex(name_array, 0)</eval>
        <eval token="last">case(name_count==1, "*", name_count==2, mvindex(name_array, 1), name_count&gt;2, mvindex(name_array, name_count - 1 ))</eval>
        <eval token="first_dot_last">if(isnotnull(mvcount(name_array)), $first$ . "." . $last$, "*")</eval>
      </change>
      <default></default>
    </input>
  </fieldset>
  <row>
    <panel>
      <html>
        name_token="$name_token$" names="$names$" normalise_names="$normalise_names$" name_count=$name_count$ first="$first$" last="$last$" first_dot_last="$first_dot_last$" 
      </html>
    </panel>
  </row>
</form>

Hopefully it gives you enough clues to get you going in your dashboard form.

View solution in original post

DesertSocBum · ‎03-16-2023

This what I have so far, So the idea is if they enter the users first and last name with a space it will transform it into first.last :

<form version="1.1" theme="dark">
  <label>Data Dump</label>
  <description>Unified Tables of Index's to pull multiple events surround a user.</description>
  <fieldset submitButton="true">
    <input type="time" token="field1">
      <label>Time Picker</label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
    <input type="text" token="field2">
      <label>Please Enter Users First and Last Name</label>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>      </table>
    </panel>
  </row>
</form>

yeahnah · ‎03-16-2023

Hi @DesertSocBum

Here's an example to create manipulate and modify the input token value using eval statements.

<form version="1.1" theme="light">
  <label>Data Dump</label>
  <description>Unified Tables of Index's to pull multiple events surround a user.</description>
  <fieldset submitButton="true">
    <input type="time" token="field1">
      <label>Time Picker</label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
    <input type="text" token="name_token">
      <label>Enter Users First and Last Name</label>
      <change>
        <set token="names">$value$</set>
        <eval token="normalise_names">if(isnotnull('value'), lower(replace('value', "\\s+", ".")), null())</eval>
        <eval token="name_array">if('normalise_names'!="", split('normalise_names', "."), null())</eval>
        <eval token="name_count">mvcount(name_array)</eval>
        <eval token="first">mvindex(name_array, 0)</eval>
        <eval token="last">case(name_count==1, "*", name_count==2, mvindex(name_array, 1), name_count&gt;2, mvindex(name_array, name_count - 1 ))</eval>
        <eval token="first_dot_last">if(isnotnull(mvcount(name_array)), $first$ . "." . $last$, "*")</eval>
      </change>
      <default></default>
    </input>
  </fieldset>
  <row>
    <panel>
      <html>
        name_token="$name_token$" names="$names$" normalise_names="$normalise_names$" name_count=$name_count$ first="$first$" last="$last$" first_dot_last="$first_dot_last$" 
      </html>
    </panel>
  </row>
</form>

Hopefully it gives you enough clues to get you going in your dashboard form.

richgalloway · ‎03-16-2023

Please share the Simple XML for the input.

---
If this reply helps you, Karma would be appreciated.

How to add formatting to text input?

dashboard

token

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

Transform your security operations with Splunk Enterprise Security

Splunk Admins and App Developers | Earn a $35 gift card!