Dashboards & Visualizations

How to add formatting to text input?

DesertSocBum
Explorer

I cant seem to find a efficient way to do this.  I have text box where a user first and last name is entered and depending on the search the token will be used but the text box is "first last" and I  need to transform it to  be either:   first.last OR first-last.

 

Please help as everything I have tried does not work. 

Labels (2)
0 Karma
1 Solution

yeahnah
Motivator

Hi @DesertSocBum 

Here's an example to create manipulate and modify the input token value using eval statements.

<form version="1.1" theme="light">
  <label>Data Dump</label>
  <description>Unified Tables of Index's to pull multiple events surround a user.</description>
  <fieldset submitButton="true">
    <input type="time" token="field1">
      <label>Time Picker</label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
    <input type="text" token="name_token">
      <label>Enter Users First and Last Name</label>
      <change>
        <set token="names">$value$</set>
        <eval token="normalise_names">if(isnotnull('value'), lower(replace('value', "\\s+", ".")), null())</eval>
        <eval token="name_array">if('normalise_names'!="", split('normalise_names', "."), null())</eval>
        <eval token="name_count">mvcount(name_array)</eval>
        <eval token="first">mvindex(name_array, 0)</eval>
        <eval token="last">case(name_count==1, "*", name_count==2, mvindex(name_array, 1), name_count&gt;2, mvindex(name_array, name_count - 1 ))</eval>
        <eval token="first_dot_last">if(isnotnull(mvcount(name_array)), $first$ . "." . $last$, "*")</eval>
      </change>
      <default></default>
    </input>
  </fieldset>
  <row>
    <panel>
      <html>
        name_token="$name_token$" names="$names$" normalise_names="$normalise_names$" name_count=$name_count$ first="$first$" last="$last$" first_dot_last="$first_dot_last$" 
      </html>
    </panel>
  </row>
</form>

 
Hopefully it gives you enough clues to get you going in your dashboard form.

View solution in original post

DesertSocBum
Explorer

This what I have so far, So the idea is if they enter the users first and last name with a space it will transform it into first.last : 

 

<form version="1.1" theme="dark">
  <label>Data Dump</label>
  <description>Unified Tables of Index's to pull multiple events surround a user.</description>
  <fieldset submitButton="true">
    <input type="time" token="field1">
      <label>Time Picker</label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
    <input type="text" token="field2">
      <label>Please Enter Users First and Last Name</label>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>      </table>
    </panel>
  </row>
</form>

 

0 Karma

yeahnah
Motivator

Hi @DesertSocBum 

Here's an example to create manipulate and modify the input token value using eval statements.

<form version="1.1" theme="light">
  <label>Data Dump</label>
  <description>Unified Tables of Index's to pull multiple events surround a user.</description>
  <fieldset submitButton="true">
    <input type="time" token="field1">
      <label>Time Picker</label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
    <input type="text" token="name_token">
      <label>Enter Users First and Last Name</label>
      <change>
        <set token="names">$value$</set>
        <eval token="normalise_names">if(isnotnull('value'), lower(replace('value', "\\s+", ".")), null())</eval>
        <eval token="name_array">if('normalise_names'!="", split('normalise_names', "."), null())</eval>
        <eval token="name_count">mvcount(name_array)</eval>
        <eval token="first">mvindex(name_array, 0)</eval>
        <eval token="last">case(name_count==1, "*", name_count==2, mvindex(name_array, 1), name_count&gt;2, mvindex(name_array, name_count - 1 ))</eval>
        <eval token="first_dot_last">if(isnotnull(mvcount(name_array)), $first$ . "." . $last$, "*")</eval>
      </change>
      <default></default>
    </input>
  </fieldset>
  <row>
    <panel>
      <html>
        name_token="$name_token$" names="$names$" normalise_names="$normalise_names$" name_count=$name_count$ first="$first$" last="$last$" first_dot_last="$first_dot_last$" 
      </html>
    </panel>
  </row>
</form>

 
Hopefully it gives you enough clues to get you going in your dashboard form.

richgalloway
SplunkTrust
SplunkTrust

Please share the Simple XML for the input.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...