Solved: How to use a custom token filter within Simple XML

Lowell · ‎10-14-2016

I'm trying to implement a custom token filter based on the Transform and validate tokens docs, but can't quite seem to make it work.

Targeting Splunk 6.3-6.5. Testing on 6.5.0.

Broken Example

Javascript $SPLUNK_HOME/etc/apps/search/appserver/static/lowell_filter.js:

require([
    "splunkjs/mvc",
    ], function(mvc) {

mvc.setFilter("testFilter", function(inputValue) {
    return "It worked " + inputValue;
});
}

Example Dashboard:

<dashboard script="lowell_filter.js">
  <label>token_test</label>
  <row>
    <panel>
      <table>
        <search>
          <query>index=_internal sourcetype=splunkd | cluster showcount=true | table _time, log_level, component, message, cluster_count | sort - cluster_count</query>
          <earliest>-1h@m</earliest>
          <latest>@m</latest>
        </search>
        <option name="drilldown">row</option>
        <drilldown>
          <set token="message">$row.message$</set>
        </drilldown>
      </table>
    </panel>
  </row>
  <row>
    <html depends="$message$">
      <h1>Message</h1>
      Filter s:  $message|s$  &lt;br/&gt;
      Filter s+u:  $message|s|u$  &lt;br/&gt;
      Filter testFilter: $message|testFilter$ &lt;br/&gt;
    </html>
  </row>
</dashboard>

When I click on a row, the s and s+u filters show what I would expected, but the last line shows the literal value, still surrounded in dollar marks.

 Filter testFilter: $message|testFilter$

Update:

I've determined that if I run the following code interactively from my browser's Javascript console, that the filter is called as expected.

window.splunkjs.mvc.setFilter("testFilter", function(inputValue) {
    return "It worked " + inputValue;
});

If I click on the table, triggering the drilldown action, then it adds the "It worked" prefix onto the token value. I think this validates that I'm calling the right function, and the desired functionality is present, just that I have something wrong in how/where I'm calling setFilter().

rjthibod · ‎10-19-2016

Add the missing the closing parenthesis to your JS file

 require([
     "splunkjs/mvc",
     ], function(mvc) {
 mvc.setFilter("testFilter", function(inputValue) {
     return "It worked " + inputValue;
   });
 });

View solution in original post

rjthibod · ‎10-19-2016

Add the missing the closing parenthesis to your JS file

 require([
     "splunkjs/mvc",
     ], function(mvc) {
 mvc.setFilter("testFilter", function(inputValue) {
     return "It worked " + inputValue;
   });
 });

How to use a custom token filter within Simple XML

.conf24 | Day 0

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

Troubleshooting the OpenTelemetry Collector