Dashboards & Visualizations

How to use the first Input Token in the second Input

digitalX
Explorer

Hi Comunity
I have some problem with input token in XML forms. The following code is working:

<form>
  <label>Update IP Blacklist</label>
  <description>Expired Bsp.: 60m, 24h, 8d, 2w, 1mon</description>
  <fieldset submitButton="true" autoRun="true">   
    <input type="text" token="Expired">
      <default>2w</default>
    </input>
    <input type="text" token="CLIENT_IP">
      <suffix>" | eval CLIENT_IP_BLACKLIST = 1 | eval CLIENT_IP_BLACKLIST_EXPIRY = relative_time(now(), "+2w") |...
...

and the following code does not: (the difference is at the end. I replaced the "+2w" with $Expired$)

<form>
  <label>Update IP Blacklist</label>
  <description>Expired Bsp.: 60m, 24h, 8d, 2w, 1mon</description>
  <fieldset submitButton="true" autoRun="true">   
    <input type="text" token="Expired">
      <default>2w</default>
    </input>
    <input type="text" token="CLIENT_IP">
      <suffix>" | eval CLIENT_IP_BLACKLIST = 1 | eval CLIENT_IP_BLACKLIST_EXPIRY = relative_time(now(), "$Expired$") |...
...

After I replaced that, I get the Error: "Unbalanced quotes." on the Dashboard. I tried it also with $Expired$ (without quotes) and $Expired|s$. Allways the same.

Has anyone a hint for me?

Tags (3)
1 Solution

gyslainlatsa
Motivator

hi digital,

in the next line, you forget to write the + before $Expired$

<suffix>" | eval CLIENT_IP_BLACKLIST = 1 | eval CLIENT_IP_BLACKLIST_EXPIRY = relative_time(now(), "$Expired$") |...

So here's what you need to write

 <suffix>" | eval CLIENT_IP_BLACKLIST = 1 | eval CLIENT_IP_BLACKLIST_EXPIRY = relative_time(now(), "+$Expired$") |...

and then tries to execute to get the result.
I waiting your remarks to see if it functioning
please forgive my english,

View solution in original post

gyslainlatsa
Motivator

hi digital,

in the next line, you forget to write the + before $Expired$

<suffix>" | eval CLIENT_IP_BLACKLIST = 1 | eval CLIENT_IP_BLACKLIST_EXPIRY = relative_time(now(), "$Expired$") |...

So here's what you need to write

 <suffix>" | eval CLIENT_IP_BLACKLIST = 1 | eval CLIENT_IP_BLACKLIST_EXPIRY = relative_time(now(), "+$Expired$") |...

and then tries to execute to get the result.
I waiting your remarks to see if it functioning
please forgive my english,

digitalX
Explorer

Yes, it works. Thank you very much! It was so clear, but I was too close in it... was searching on the wrong places.
Your english is perfect for me and my understanding, coming from switzerland. 🙂

gyslainlatsa
Motivator

hi digitalx,
thank you for your compliment, I coming from Cameroon but I work online to a resident of the USA,
we can work together to later if you wish, to help each other together in case of difficulties, here is my email: gyslainko@gmail.com
see you soon.

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Index This | What travels the world but is also stuck in place?

April 2026 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Discover New Use Cases: Unlock Greater Value from Your Existing Splunk Data

Realizing the full potential of your Splunk investment requires more than just understanding current usage; it ...

Continue Your Journey: Join Session 2 of the Data Management and Federation Bootcamp ...

As data volumes continue to grow and environments become more distributed, managing and optimizing data ...