Dashboards & Visualizations

How to use the first Input Token in the second Input

digitalX
Explorer

Hi Comunity
I have some problem with input token in XML forms. The following code is working:

<form>
  <label>Update IP Blacklist</label>
  <description>Expired Bsp.: 60m, 24h, 8d, 2w, 1mon</description>
  <fieldset submitButton="true" autoRun="true">   
    <input type="text" token="Expired">
      <default>2w</default>
    </input>
    <input type="text" token="CLIENT_IP">
      <suffix>" | eval CLIENT_IP_BLACKLIST = 1 | eval CLIENT_IP_BLACKLIST_EXPIRY = relative_time(now(), "+2w") |...
...

and the following code does not: (the difference is at the end. I replaced the "+2w" with $Expired$)

<form>
  <label>Update IP Blacklist</label>
  <description>Expired Bsp.: 60m, 24h, 8d, 2w, 1mon</description>
  <fieldset submitButton="true" autoRun="true">   
    <input type="text" token="Expired">
      <default>2w</default>
    </input>
    <input type="text" token="CLIENT_IP">
      <suffix>" | eval CLIENT_IP_BLACKLIST = 1 | eval CLIENT_IP_BLACKLIST_EXPIRY = relative_time(now(), "$Expired$") |...
...

After I replaced that, I get the Error: "Unbalanced quotes." on the Dashboard. I tried it also with $Expired$ (without quotes) and $Expired|s$. Allways the same.

Has anyone a hint for me?

Tags (3)
1 Solution

gyslainlatsa
Motivator

hi digital,

in the next line, you forget to write the + before $Expired$

<suffix>" | eval CLIENT_IP_BLACKLIST = 1 | eval CLIENT_IP_BLACKLIST_EXPIRY = relative_time(now(), "$Expired$") |...

So here's what you need to write

 <suffix>" | eval CLIENT_IP_BLACKLIST = 1 | eval CLIENT_IP_BLACKLIST_EXPIRY = relative_time(now(), "+$Expired$") |...

and then tries to execute to get the result.
I waiting your remarks to see if it functioning
please forgive my english,

View solution in original post

gyslainlatsa
Motivator

hi digital,

in the next line, you forget to write the + before $Expired$

<suffix>" | eval CLIENT_IP_BLACKLIST = 1 | eval CLIENT_IP_BLACKLIST_EXPIRY = relative_time(now(), "$Expired$") |...

So here's what you need to write

 <suffix>" | eval CLIENT_IP_BLACKLIST = 1 | eval CLIENT_IP_BLACKLIST_EXPIRY = relative_time(now(), "+$Expired$") |...

and then tries to execute to get the result.
I waiting your remarks to see if it functioning
please forgive my english,

digitalX
Explorer

Yes, it works. Thank you very much! It was so clear, but I was too close in it... was searching on the wrong places.
Your english is perfect for me and my understanding, coming from switzerland. 🙂

gyslainlatsa
Motivator

hi digitalx,
thank you for your compliment, I coming from Cameroon but I work online to a resident of the USA,
we can work together to later if you wish, to help each other together in case of difficulties, here is my email: gyslainko@gmail.com
see you soon.

Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...