Dashboards & Visualizations

How to transform text type token values on dashboard?

hollybross1219
Path Finder

Hi there,

I have a dashboard with a text box field. My goal is to make this field more flexible for different input variations so that you don't need exact text match to get a result.

Basically how can I transform the token value of inputs so that the token value in my SPL query is transformed so it's all lower case without spaces? 

For example, if someone searches for any of the following:

  1. "Bank of America"
  2. "bank of America"
  3. "bank of america"
  4. "BANK OF AMERICA"

The token value for all entries above will be transformed to "bankofamerica" (no space, all lower), which will THEN be used as a search value in my SPL query.

I just know the basics of token usage, but haven't done any transforms and the documentation is confusing...please help!!

Labels (1)
Tags (2)
1 Solution

niketn
Legend

@hollybross1219  you may not need to change the casing unless you are doing strict case sensitive search. By default it should be case-insensitive. However, for removing spaces you will use the method provided by @ITWhisperer but that would be an independent search which consumes the token from text box and outputs the required data. (PS: Same could also have been done using <change> event handler for text box input and use <eval> to set required token. However, SimpleXML eval to set token does not play nicely with regular expressions. So, Independent search is your alternative).

Try the following run anywhere example:

<form>
  <label>Text Box Filter</label>
  <fieldset submitButton="false">
    <input type="text" token="filter" searchWhenChanged="true">
      <label>Filter</label>
      <default>Bank Of America</default>
    </input>
  </fieldset>
  <!-- Independent search to set the final token without spaces. -->
  <search>
    <query>| makeresults
    | fields - _time
    | eval updatedFilter=replace("$filter$","\s","")
    </query>
    <done>
      <set token="updatedFilter">$result.updatedFilter$</set>
    </done>
  </search>
  <row>
    <panel>
      <html>
        <div>filter: $filter$</div>
        <div>updatedFilter: $updatedFilter$</div>
      </html>
    </panel>
  </row>
</form>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn
Legend

@hollybross1219  you may not need to change the casing unless you are doing strict case sensitive search. By default it should be case-insensitive. However, for removing spaces you will use the method provided by @ITWhisperer but that would be an independent search which consumes the token from text box and outputs the required data. (PS: Same could also have been done using <change> event handler for text box input and use <eval> to set required token. However, SimpleXML eval to set token does not play nicely with regular expressions. So, Independent search is your alternative).

Try the following run anywhere example:

<form>
  <label>Text Box Filter</label>
  <fieldset submitButton="false">
    <input type="text" token="filter" searchWhenChanged="true">
      <label>Filter</label>
      <default>Bank Of America</default>
    </input>
  </fieldset>
  <!-- Independent search to set the final token without spaces. -->
  <search>
    <query>| makeresults
    | fields - _time
    | eval updatedFilter=replace("$filter$","\s","")
    </query>
    <done>
      <set token="updatedFilter">$result.updatedFilter$</set>
    </done>
  </search>
  <row>
    <panel>
      <html>
        <div>filter: $filter$</div>
        <div>updatedFilter: $updatedFilter$</div>
      </html>
    </panel>
  </row>
</form>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

hollybross1219
Path Finder

This is perfect @niketn ! Thank you!

QQ -- What does this do in the <search>? 

| fields - _time

 I removed it and my dashboard kept scrolling all the way to the bottom... I added it back then it behaved correctly.

I'm not sure if my Dashboard was misbehaving due the absence of this or for some other reason...

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| eval token=lower(replace(token,"\s",""))
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...