Solved: Re: Add formatting to text input

DesertSocBum · ‎03-16-2023

I cant seem to find a efficient way to do this. I have text box where a user first and last name is entered and depending on the search the token will be used but the text box is "first last" and I need to transform it to be either: first.last OR first-last.

Please help as everything I have tried does not work.

yeahnah · ‎03-16-2023

Hi @DesertSocBum

Here's an example to create manipulate and modify the input token value using eval statements.

<form version="1.1" theme="light">
  <label>Data Dump</label>
  <description>Unified Tables of Index's to pull multiple events surround a user.</description>
  <fieldset submitButton="true">
    <input type="time" token="field1">
      <label>Time Picker</label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
    <input type="text" token="name_token">
      <label>Enter Users First and Last Name</label>
      <change>
        <set token="names">$value$</set>
        <eval token="normalise_names">if(isnotnull('value'), lower(replace('value', "\\s+", ".")), null())</eval>
        <eval token="name_array">if('normalise_names'!="", split('normalise_names', "."), null())</eval>
        <eval token="name_count">mvcount(name_array)</eval>
        <eval token="first">mvindex(name_array, 0)</eval>
        <eval token="last">case(name_count==1, "*", name_count==2, mvindex(name_array, 1), name_count&gt;2, mvindex(name_array, name_count - 1 ))</eval>
        <eval token="first_dot_last">if(isnotnull(mvcount(name_array)), $first$ . "." . $last$, "*")</eval>
      </change>
      <default></default>
    </input>
  </fieldset>
  <row>
    <panel>
      <html>
        name_token="$name_token$" names="$names$" normalise_names="$normalise_names$" name_count=$name_count$ first="$first$" last="$last$" first_dot_last="$first_dot_last$" 
      </html>
    </panel>
  </row>
</form>

Hopefully it gives you enough clues to get you going in your dashboard form.

View solution in original post

DesertSocBum · ‎03-16-2023

This what I have so far, So the idea is if they enter the users first and last name with a space it will transform it into first.last :

<form version="1.1" theme="dark">
  <label>Data Dump</label>
  <description>Unified Tables of Index's to pull multiple events surround a user.</description>
  <fieldset submitButton="true">
    <input type="time" token="field1">
      <label>Time Picker</label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
    <input type="text" token="field2">
      <label>Please Enter Users First and Last Name</label>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>      </table>
    </panel>
  </row>
</form>

yeahnah · ‎03-16-2023

Hi @DesertSocBum

Here's an example to create manipulate and modify the input token value using eval statements.

<form version="1.1" theme="light">
  <label>Data Dump</label>
  <description>Unified Tables of Index's to pull multiple events surround a user.</description>
  <fieldset submitButton="true">
    <input type="time" token="field1">
      <label>Time Picker</label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
    <input type="text" token="name_token">
      <label>Enter Users First and Last Name</label>
      <change>
        <set token="names">$value$</set>
        <eval token="normalise_names">if(isnotnull('value'), lower(replace('value', "\\s+", ".")), null())</eval>
        <eval token="name_array">if('normalise_names'!="", split('normalise_names', "."), null())</eval>
        <eval token="name_count">mvcount(name_array)</eval>
        <eval token="first">mvindex(name_array, 0)</eval>
        <eval token="last">case(name_count==1, "*", name_count==2, mvindex(name_array, 1), name_count&gt;2, mvindex(name_array, name_count - 1 ))</eval>
        <eval token="first_dot_last">if(isnotnull(mvcount(name_array)), $first$ . "." . $last$, "*")</eval>
      </change>
      <default></default>
    </input>
  </fieldset>
  <row>
    <panel>
      <html>
        name_token="$name_token$" names="$names$" normalise_names="$normalise_names$" name_count=$name_count$ first="$first$" last="$last$" first_dot_last="$first_dot_last$" 
      </html>
    </panel>
  </row>
</form>

Hopefully it gives you enough clues to get you going in your dashboard form.

richgalloway · ‎03-16-2023

Please share the Simple XML for the input.

---
If this reply helps you, Karma would be appreciated.

How to add formatting to text input?

dashboard

token

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

A Four-Part Event Series: Full Stack Observability For the AI Era

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

Event Series: Level up your SOC: Advancing with Splunk Enterprise Security

Join the Conversation