Dashboards & Visualizations

How to transform text type token values on dashboard?

hollybross1219
Path Finder

Hi there,

I have a dashboard with a text box field. My goal is to make this field more flexible for different input variations so that you don't need exact text match to get a result.

Basically how can I transform the token value of inputs so that the token value in my SPL query is transformed so it's all lower case without spaces? 

For example, if someone searches for any of the following:

  1. "Bank of America"
  2. "bank of America"
  3. "bank of america"
  4. "BANK OF AMERICA"

The token value for all entries above will be transformed to "bankofamerica" (no space, all lower), which will THEN be used as a search value in my SPL query.

I just know the basics of token usage, but haven't done any transforms and the documentation is confusing...please help!!

Labels (1)
Tags (2)
1 Solution

niketn
Legend

@hollybross1219  you may not need to change the casing unless you are doing strict case sensitive search. By default it should be case-insensitive. However, for removing spaces you will use the method provided by @ITWhisperer but that would be an independent search which consumes the token from text box and outputs the required data. (PS: Same could also have been done using <change> event handler for text box input and use <eval> to set required token. However, SimpleXML eval to set token does not play nicely with regular expressions. So, Independent search is your alternative).

Try the following run anywhere example:

<form>
  <label>Text Box Filter</label>
  <fieldset submitButton="false">
    <input type="text" token="filter" searchWhenChanged="true">
      <label>Filter</label>
      <default>Bank Of America</default>
    </input>
  </fieldset>
  <!-- Independent search to set the final token without spaces. -->
  <search>
    <query>| makeresults
    | fields - _time
    | eval updatedFilter=replace("$filter$","\s","")
    </query>
    <done>
      <set token="updatedFilter">$result.updatedFilter$</set>
    </done>
  </search>
  <row>
    <panel>
      <html>
        <div>filter: $filter$</div>
        <div>updatedFilter: $updatedFilter$</div>
      </html>
    </panel>
  </row>
</form>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn
Legend

@hollybross1219  you may not need to change the casing unless you are doing strict case sensitive search. By default it should be case-insensitive. However, for removing spaces you will use the method provided by @ITWhisperer but that would be an independent search which consumes the token from text box and outputs the required data. (PS: Same could also have been done using <change> event handler for text box input and use <eval> to set required token. However, SimpleXML eval to set token does not play nicely with regular expressions. So, Independent search is your alternative).

Try the following run anywhere example:

<form>
  <label>Text Box Filter</label>
  <fieldset submitButton="false">
    <input type="text" token="filter" searchWhenChanged="true">
      <label>Filter</label>
      <default>Bank Of America</default>
    </input>
  </fieldset>
  <!-- Independent search to set the final token without spaces. -->
  <search>
    <query>| makeresults
    | fields - _time
    | eval updatedFilter=replace("$filter$","\s","")
    </query>
    <done>
      <set token="updatedFilter">$result.updatedFilter$</set>
    </done>
  </search>
  <row>
    <panel>
      <html>
        <div>filter: $filter$</div>
        <div>updatedFilter: $updatedFilter$</div>
      </html>
    </panel>
  </row>
</form>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

hollybross1219
Path Finder

This is perfect @niketn ! Thank you!

QQ -- What does this do in the <search>? 

| fields - _time

 I removed it and my dashboard kept scrolling all the way to the bottom... I added it back then it behaved correctly.

I'm not sure if my Dashboard was misbehaving due the absence of this or for some other reason...

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| eval token=lower(replace(token,"\s",""))
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...