Solved: How to transform text type token values on dashboa...

hollybross1219 · ‎10-09-2020

Hi there,

I have a dashboard with a text box field. My goal is to make this field more flexible for different input variations so that you don't need exact text match to get a result.

Basically how can I transform the token value of inputs so that the token value in my SPL query is transformed so it's all lower case without spaces?

For example, if someone searches for any of the following:

"Bank of America"
"bank of America"
"bank of america"
"BANK OF AMERICA"

The token value for all entries above will be transformed to "bankofamerica" (no space, all lower), which will THEN be used as a search value in my SPL query.

I just know the basics of token usage, but haven't done any transforms and the documentation is confusing...please help!!

niketn · ‎10-11-2020

@hollybross1219 you may not need to change the casing unless you are doing strict case sensitive search. By default it should be case-insensitive. However, for removing spaces you will use the method provided by @ITWhisperer but that would be an independent search which consumes the token from text box and outputs the required data. (PS: Same could also have been done using <change> event handler for text box input and use <eval> to set required token. However, SimpleXML eval to set token does not play nicely with regular expressions. So, Independent search is your alternative).

Try the following run anywhere example:

<form>
  <label>Text Box Filter</label>
  <fieldset submitButton="false">
    <input type="text" token="filter" searchWhenChanged="true">
      <label>Filter</label>
      <default>Bank Of America</default>
    </input>
  </fieldset>
  <!-- Independent search to set the final token without spaces. -->
  <search>
    <query>| makeresults
    | fields - _time
    | eval updatedFilter=replace("$filter$","\s","")
    </query>
    <done>
      <set token="updatedFilter">$result.updatedFilter$</set>
    </done>
  </search>
  <row>
    <panel>
      <html>
        <div>filter: $filter$</div>
        <div>updatedFilter: $updatedFilter$</div>
      </html>
    </panel>
  </row>
</form>

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn · ‎10-11-2020

@hollybross1219 you may not need to change the casing unless you are doing strict case sensitive search. By default it should be case-insensitive. However, for removing spaces you will use the method provided by @ITWhisperer but that would be an independent search which consumes the token from text box and outputs the required data. (PS: Same could also have been done using <change> event handler for text box input and use <eval> to set required token. However, SimpleXML eval to set token does not play nicely with regular expressions. So, Independent search is your alternative).

Try the following run anywhere example:

<form>
  <label>Text Box Filter</label>
  <fieldset submitButton="false">
    <input type="text" token="filter" searchWhenChanged="true">
      <label>Filter</label>
      <default>Bank Of America</default>
    </input>
  </fieldset>
  <!-- Independent search to set the final token without spaces. -->
  <search>
    <query>| makeresults
    | fields - _time
    | eval updatedFilter=replace("$filter$","\s","")
    </query>
    <done>
      <set token="updatedFilter">$result.updatedFilter$</set>
    </done>
  </search>
  <row>
    <panel>
      <html>
        <div>filter: $filter$</div>
        <div>updatedFilter: $updatedFilter$</div>
      </html>
    </panel>
  </row>
</form>

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

hollybross1219 · ‎10-15-2020

This is perfect @niketn ! Thank you!

QQ -- What does this do in the <search>?

| fields - _time

I removed it and my dashboard kept scrolling all the way to the bottom... I added it back then it behaved correctly.

I'm not sure if my Dashboard was misbehaving due the absence of this or for some other reason...

ITWhisperer · ‎10-09-2020

| eval token=lower(replace(token,"\s",""))

How to transform text type token values on dashboard?

token

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Automating Threat Operations and Threat Hunting with Recorded Future

Join the Conversation