Dashboards & Visualizations

How to replace every backslash in an input form token with a double backslash

Communicator

Hello,
please I would like to know how I can replace a single "\" backslash with a double "\" backslash in a form input (simple xml) before submitting it.

I have tried with this code, but it does not work with splunk 6.5.x

    <input type="text" token="progetto">
      <label>Progetto (raddoppiare i "\")</label>
      <default>*</default>
      <initialValue>*</initialValue>
      <change>
         <eval token="progetto">replace('progetto',"\\\","\\\\\\")</eval>     
      </change>
    </input>

Thanks in advance.

0 Karma
1 Solution

Communicator

I have found out a way to get what I want: it's done with custom JS code.

This is the form:

<form script="token_modify_mae.js">
   <label>test1</label>
   <fieldset>
     <input type="text" token="mytoken">
       <label>field1</label>
     </input>
   </fieldset>
   <row>
     <html>
       <p>Value1: $mytoken$</p>
       <p>Value2: $mymodtoken$</p>
     </html>
   </row>
 </form>

and this is the JS code:

require([
    "splunkjs/mvc",
    "splunkjs/mvc/simplexml/ready!"
], function(mvc) {
var defaultTokenModel = mvc.Components.get("default");
defaultTokenModel.on("change:mytoken", function(formQuery, mytoken) {
            alert("change it!");
            var tokenValue = defaultTokenModel.get("mytoken");
            newtoken = tokenValue.replace(/\\/g, "\\\\");
            defaultTokenModel.set('mymodtoken', newtoken);
        });
});

View solution in original post

Communicator

I have found out a way to get what I want: it's done with custom JS code.

This is the form:

<form script="token_modify_mae.js">
   <label>test1</label>
   <fieldset>
     <input type="text" token="mytoken">
       <label>field1</label>
     </input>
   </fieldset>
   <row>
     <html>
       <p>Value1: $mytoken$</p>
       <p>Value2: $mymodtoken$</p>
     </html>
   </row>
 </form>

and this is the JS code:

require([
    "splunkjs/mvc",
    "splunkjs/mvc/simplexml/ready!"
], function(mvc) {
var defaultTokenModel = mvc.Components.get("default");
defaultTokenModel.on("change:mytoken", function(formQuery, mytoken) {
            alert("change it!");
            var tokenValue = defaultTokenModel.get("mytoken");
            newtoken = tokenValue.replace(/\\/g, "\\\\");
            defaultTokenModel.set('mymodtoken', newtoken);
        });
});

View solution in original post

Communicator

@DMohn: please, could you please provide me the complete form you used? Mine hangs on "waiting for input", even if I put test2 in my search query.
Thanks.

Motivator
<form>
  <label>test1</label>
  <fieldset>
    <input type="text" token="test1">
      <label>field1</label>
      <change>
        <eval token="test2">replace('test1',"\\\\","\\\\")</eval>
      </change>
    </input>
  </fieldset>
  <row>
    <html>
      <p>Value1: $test1$</p>
      <p>Value2: $test2$</p>
    </html>
  </row>
</form>
0 Karma

Engager
<form>
  <label>test1</label>
  <fieldset>
    <input type="text" token="test1" searchWhenChanged="true">
      <label>field1</label>
      <change>
        <eval token="test2">replace($form.test1$,"\\\\","\\\\")</eval>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <html>
       <p>Value1: $test1$</p>
       <p>Value2: $test2$</p>
     </html>
    </panel>
  </row>
</form>

Changing 'test1' -> $form.test1$ seems to fix the issue cafissimo was having. I also think the searchWhenChanged might also be key to making this all work.

0 Karma

Communicator

I am sorry, but it works in a weird way.
At first run of the form, if I put "\" in field1 nothing happens and field2 is shown as "$field2$".
If I add another "\" in field1 ("\") and submit again, the field2 value appears as "\\".
By the way, what I need is to repeat each "\" character.
For example:
\NAS\disc1\disc2 should become "\\NAS\disc1\disc2"
Maybe I should use javascript?

I am running splunk 6.5.3

0 Karma

Motivator

Hi @cafissimo

As paradox as it may seem - try the following code:

<fieldset>
  <input type="text" token="test1">
    <label>field1</label>
    <change>
      <eval token="test2">replace('test1',"\\\\","\\\\")</eval>
    </change>
  </input>
</fieldset>

This renders the correct results for me.

Communicator

Progetto="$progetto$|s", with an initial value of "" for progetto field gives no results.
Also tried with value "\NAS
" and still get no results.
(Obviously there are a lot of records in the index that have "\NAS" at the beginning of the field).

0 Karma

Super Champion

have you tried using field=$progetto|s$ in your search instead of trying to escape the backslash in your input? the |s will enclose the token in quotes and that might work.

also, i did test your input on 6.6.1, and it seems to work there if you plan on upgrading anytime soon.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!