Solved: How to add formatting to text input?

DesertSocBum · ‎03-16-2023

I cant seem to find a efficient way to do this. I have text box where a user first and last name is entered and depending on the search the token will be used but the text box is "first last" and I need to transform it to be either: first.last OR first-last.

Please help as everything I have tried does not work.

yeahnah · ‎03-16-2023

Hi @DesertSocBum

Here's an example to create manipulate and modify the input token value using eval statements.

<form version="1.1" theme="light">
  <label>Data Dump</label>
  <description>Unified Tables of Index's to pull multiple events surround a user.</description>
  <fieldset submitButton="true">
    <input type="time" token="field1">
      <label>Time Picker</label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
    <input type="text" token="name_token">
      <label>Enter Users First and Last Name</label>
      <change>
        <set token="names">$value$</set>
        <eval token="normalise_names">if(isnotnull('value'), lower(replace('value', "\\s+", ".")), null())</eval>
        <eval token="name_array">if('normalise_names'!="", split('normalise_names', "."), null())</eval>
        <eval token="name_count">mvcount(name_array)</eval>
        <eval token="first">mvindex(name_array, 0)</eval>
        <eval token="last">case(name_count==1, "*", name_count==2, mvindex(name_array, 1), name_count&gt;2, mvindex(name_array, name_count - 1 ))</eval>
        <eval token="first_dot_last">if(isnotnull(mvcount(name_array)), $first$ . "." . $last$, "*")</eval>
      </change>
      <default></default>
    </input>
  </fieldset>
  <row>
    <panel>
      <html>
        name_token="$name_token$" names="$names$" normalise_names="$normalise_names$" name_count=$name_count$ first="$first$" last="$last$" first_dot_last="$first_dot_last$" 
      </html>
    </panel>
  </row>
</form>

Hopefully it gives you enough clues to get you going in your dashboard form.

View solution in original post

DesertSocBum · ‎03-16-2023

This what I have so far, So the idea is if they enter the users first and last name with a space it will transform it into first.last :

<form version="1.1" theme="dark">
  <label>Data Dump</label>
  <description>Unified Tables of Index's to pull multiple events surround a user.</description>
  <fieldset submitButton="true">
    <input type="time" token="field1">
      <label>Time Picker</label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
    <input type="text" token="field2">
      <label>Please Enter Users First and Last Name</label>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>      </table>
    </panel>
  </row>
</form>

yeahnah · ‎03-16-2023

Hi @DesertSocBum

Here's an example to create manipulate and modify the input token value using eval statements.

<form version="1.1" theme="light">
  <label>Data Dump</label>
  <description>Unified Tables of Index's to pull multiple events surround a user.</description>
  <fieldset submitButton="true">
    <input type="time" token="field1">
      <label>Time Picker</label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
    <input type="text" token="name_token">
      <label>Enter Users First and Last Name</label>
      <change>
        <set token="names">$value$</set>
        <eval token="normalise_names">if(isnotnull('value'), lower(replace('value', "\\s+", ".")), null())</eval>
        <eval token="name_array">if('normalise_names'!="", split('normalise_names', "."), null())</eval>
        <eval token="name_count">mvcount(name_array)</eval>
        <eval token="first">mvindex(name_array, 0)</eval>
        <eval token="last">case(name_count==1, "*", name_count==2, mvindex(name_array, 1), name_count&gt;2, mvindex(name_array, name_count - 1 ))</eval>
        <eval token="first_dot_last">if(isnotnull(mvcount(name_array)), $first$ . "." . $last$, "*")</eval>
      </change>
      <default></default>
    </input>
  </fieldset>
  <row>
    <panel>
      <html>
        name_token="$name_token$" names="$names$" normalise_names="$normalise_names$" name_count=$name_count$ first="$first$" last="$last$" first_dot_last="$first_dot_last$" 
      </html>
    </panel>
  </row>
</form>

Hopefully it gives you enough clues to get you going in your dashboard form.

richgalloway · ‎03-16-2023

Please share the Simple XML for the input.

---
If this reply helps you, Karma would be appreciated.

How to add formatting to text input?

dashboard

token

Preparing your Splunk Environment for OpenSSL3

Deprecation of Splunk Observability Kubernetes “Classic Navigator” UI starting ...

Now Available: Cisco Talos Threat Intelligence Integrations for Splunk Security Cloud ...