Dashboards & Visualizations

How to replace every backslash in an input form token with a double backslash

cafissimo
Communicator

Hello,
please I would like to know how I can replace a single "\" backslash with a double "\" backslash in a form input (simple xml) before submitting it.

I have tried with this code, but it does not work with splunk 6.5.x

    <input type="text" token="progetto">
      <label>Progetto (raddoppiare i "\")</label>
      <default>*</default>
      <initialValue>*</initialValue>
      <change>
         <eval token="progetto">replace('progetto',"\\\","\\\\\\")</eval>     
      </change>
    </input>

Thanks in advance.

0 Karma
1 Solution

cafissimo
Communicator

I have found out a way to get what I want: it's done with custom JS code.

This is the form:

<form script="token_modify_mae.js">
   <label>test1</label>
   <fieldset>
     <input type="text" token="mytoken">
       <label>field1</label>
     </input>
   </fieldset>
   <row>
     <html>
       <p>Value1: $mytoken$</p>
       <p>Value2: $mymodtoken$</p>
     </html>
   </row>
 </form>

and this is the JS code:

require([
    "splunkjs/mvc",
    "splunkjs/mvc/simplexml/ready!"
], function(mvc) {
var defaultTokenModel = mvc.Components.get("default");
defaultTokenModel.on("change:mytoken", function(formQuery, mytoken) {
            alert("change it!");
            var tokenValue = defaultTokenModel.get("mytoken");
            newtoken = tokenValue.replace(/\\/g, "\\\\");
            defaultTokenModel.set('mymodtoken', newtoken);
        });
});

View solution in original post

cafissimo
Communicator

I have found out a way to get what I want: it's done with custom JS code.

This is the form:

<form script="token_modify_mae.js">
   <label>test1</label>
   <fieldset>
     <input type="text" token="mytoken">
       <label>field1</label>
     </input>
   </fieldset>
   <row>
     <html>
       <p>Value1: $mytoken$</p>
       <p>Value2: $mymodtoken$</p>
     </html>
   </row>
 </form>

and this is the JS code:

require([
    "splunkjs/mvc",
    "splunkjs/mvc/simplexml/ready!"
], function(mvc) {
var defaultTokenModel = mvc.Components.get("default");
defaultTokenModel.on("change:mytoken", function(formQuery, mytoken) {
            alert("change it!");
            var tokenValue = defaultTokenModel.get("mytoken");
            newtoken = tokenValue.replace(/\\/g, "\\\\");
            defaultTokenModel.set('mymodtoken', newtoken);
        });
});

cafissimo
Communicator

@DMohn: please, could you please provide me the complete form you used? Mine hangs on "waiting for input", even if I put test2 in my search query.
Thanks.

DMohn
Motivator
<form>
  <label>test1</label>
  <fieldset>
    <input type="text" token="test1">
      <label>field1</label>
      <change>
        <eval token="test2">replace('test1',"\\\\","\\\\")</eval>
      </change>
    </input>
  </fieldset>
  <row>
    <html>
      <p>Value1: $test1$</p>
      <p>Value2: $test2$</p>
    </html>
  </row>
</form>
0 Karma

bekirk
Engager
<form>
  <label>test1</label>
  <fieldset>
    <input type="text" token="test1" searchWhenChanged="true">
      <label>field1</label>
      <change>
        <eval token="test2">replace($form.test1$,"\\\\","\\\\")</eval>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <html>
       <p>Value1: $test1$</p>
       <p>Value2: $test2$</p>
     </html>
    </panel>
  </row>
</form>

Changing 'test1' -> $form.test1$ seems to fix the issue cafissimo was having. I also think the searchWhenChanged might also be key to making this all work.

0 Karma

cafissimo
Communicator

I am sorry, but it works in a weird way.
At first run of the form, if I put "\" in field1 nothing happens and field2 is shown as "$field2$".
If I add another "\" in field1 ("\") and submit again, the field2 value appears as "\\".
By the way, what I need is to repeat each "\" character.
For example:
\NAS\disc1\disc2 should become "\\NAS\disc1\disc2"
Maybe I should use javascript?

I am running splunk 6.5.3

0 Karma

DMohn
Motivator

Hi @cafissimo

As paradox as it may seem - try the following code:

<fieldset>
  <input type="text" token="test1">
    <label>field1</label>
    <change>
      <eval token="test2">replace('test1',"\\\\","\\\\")</eval>
    </change>
  </input>
</fieldset>

This renders the correct results for me.

cafissimo
Communicator

Progetto="$progetto$|s", with an initial value of "" for progetto field gives no results.
Also tried with value "\NAS
" and still get no results.
(Obviously there are a lot of records in the index that have "\NAS" at the beginning of the field).

0 Karma

cmerriman
Super Champion

have you tried using field=$progetto|s$ in your search instead of trying to escape the backslash in your input? the |s will enclose the token in quotes and that might work.

also, i did test your input on 6.6.1, and it seems to work there if you plan on upgrading anytime soon.

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...