Dashboards & Visualizations

How to append in stringreplace Advanced XML

mjohanne
Explorer

Hello,

I am trying to modify a custom UI that uses a HiddenSearch and fields to fill its values. For one of the fields if a user enters a value ("123" for example) we need to create the search token to look like "source=*\\ID_123\\*". If the field is left blank than nothing is added.

Using the prefix option in stringreplace I am able to get part of what is needed (source=*\\ID_123), but can not find a way to get the "\\*" appended.

See code snippets below. Any suggestions on how this can be done?

Thanks in advance.

<module name="HiddenSearch" layoutPanel="mainSearchControls">
  <param name="search">index=aqua $instanceToken$ $reverseToken$</param>

<module name="ExtendedFieldSearch">
  <param name="field">Instance</param>
  <param name="intention">
    <param name="name">stringreplace</param>
    <param name="arg">
      <param name="instanceToken">
        <param name="fillOnEmpty">false</param>
        <param name="prefix">source=*\\</param>
      </param>
    </param>
  </param>
  <param name="replacementMap">
    <param name="arg">
      <param name="instanceToken">
        <param name="value">$instanceToken$</param>
      </param>
    </param>
  </param>
1 Solution

Johnvey
Contributor

Add a matching suffix parameter to your config:

    <param name="fillOnEmpty">false</param>
    <param name="prefix">source=*\\</param>
    <param name="suffix">\\*</param>

As you've already done, the fillOnEmpty flag will prevent anything from being injected if the user has not entered anything into the text box.

View solution in original post

Johnvey
Contributor

Add a matching suffix parameter to your config:

    <param name="fillOnEmpty">false</param>
    <param name="prefix">source=*\\</param>
    <param name="suffix">\\*</param>

As you've already done, the fillOnEmpty flag will prevent anything from being injected if the user has not entered anything into the text box.

mjohanne
Explorer

Thanks, that got it working.

0 Karma

sideview
SplunkTrust
SplunkTrust

If you install the Sideview Utils app, this becomes a lot easier with its TextField module. There's probably a way to do a suffix in ExtendedFieldSearch but it's not in the replacement map, and I dont think you can just put a 'suffix' into the stringreplace intention, and that would leave hardwiring it in the HiddenSearch which isnt a very good idea.

Here's the equivalent config in Sideview Utils. It's a bit easier as you see. Note that either way you almost certainly will need to backslash-escape those backslashes.

<module name="TextField">
  <param name="name">source</param>
  <param name="template">$name$="*\\\\$value$\\\\*"</param>
  <param name="label">Source:</param>
  ....

With the TextField module, you can just refer to this token (in all it's source="*\\*" glory), within Sideview's Search module, just by $source$. You wont need any intentions if you use both the TextField module instead of ExtendedFieldSearch, and the Search module instead of HiddenSearch.

You also may want to debug the token so that you can check that the backslash escaping is working. You can do that just by putting an HTML module inside the TextField, like so:

<module name="TextField">
  <param name="name">source</param>
  <param name="template">$name$="*\\\\$value$\\\\*"</param>
  <param name="label">Source:</param>
  <module name="HTML">
    <param name="html"><![CDATA[
      Debugging: <br>
      (use this when you're doing search language in Search or PostProcess)<br>
      source = $source$ <br>
      <br>
      (use this when you're making headers for the user)<br>
      source.rawValue = $source.rawValue$  <br>

    ]]></param>
  </module>
  ....

mjohanne
Explorer

Thanks for the info, I will look at Sideview for use in the future.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...