Dashboards & Visualizations

How to use the first Input Token in the second Input

digitalX
Explorer

Hi Comunity
I have some problem with input token in XML forms. The following code is working:

<form>
  <label>Update IP Blacklist</label>
  <description>Expired Bsp.: 60m, 24h, 8d, 2w, 1mon</description>
  <fieldset submitButton="true" autoRun="true">   
    <input type="text" token="Expired">
      <default>2w</default>
    </input>
    <input type="text" token="CLIENT_IP">
      <suffix>" | eval CLIENT_IP_BLACKLIST = 1 | eval CLIENT_IP_BLACKLIST_EXPIRY = relative_time(now(), "+2w") |...
...

and the following code does not: (the difference is at the end. I replaced the "+2w" with $Expired$)

<form>
  <label>Update IP Blacklist</label>
  <description>Expired Bsp.: 60m, 24h, 8d, 2w, 1mon</description>
  <fieldset submitButton="true" autoRun="true">   
    <input type="text" token="Expired">
      <default>2w</default>
    </input>
    <input type="text" token="CLIENT_IP">
      <suffix>" | eval CLIENT_IP_BLACKLIST = 1 | eval CLIENT_IP_BLACKLIST_EXPIRY = relative_time(now(), "$Expired$") |...
...

After I replaced that, I get the Error: "Unbalanced quotes." on the Dashboard. I tried it also with $Expired$ (without quotes) and $Expired|s$. Allways the same.

Has anyone a hint for me?

Tags (3)
1 Solution

gyslainlatsa
Motivator

hi digital,

in the next line, you forget to write the + before $Expired$

<suffix>" | eval CLIENT_IP_BLACKLIST = 1 | eval CLIENT_IP_BLACKLIST_EXPIRY = relative_time(now(), "$Expired$") |...

So here's what you need to write

 <suffix>" | eval CLIENT_IP_BLACKLIST = 1 | eval CLIENT_IP_BLACKLIST_EXPIRY = relative_time(now(), "+$Expired$") |...

and then tries to execute to get the result.
I waiting your remarks to see if it functioning
please forgive my english,

View solution in original post

gyslainlatsa
Motivator

hi digital,

in the next line, you forget to write the + before $Expired$

<suffix>" | eval CLIENT_IP_BLACKLIST = 1 | eval CLIENT_IP_BLACKLIST_EXPIRY = relative_time(now(), "$Expired$") |...

So here's what you need to write

 <suffix>" | eval CLIENT_IP_BLACKLIST = 1 | eval CLIENT_IP_BLACKLIST_EXPIRY = relative_time(now(), "+$Expired$") |...

and then tries to execute to get the result.
I waiting your remarks to see if it functioning
please forgive my english,

digitalX
Explorer

Yes, it works. Thank you very much! It was so clear, but I was too close in it... was searching on the wrong places.
Your english is perfect for me and my understanding, coming from switzerland. 🙂

gyslainlatsa
Motivator

hi digitalx,
thank you for your compliment, I coming from Cameroon but I work online to a resident of the USA,
we can work together to later if you wish, to help each other together in case of difficulties, here is my email: gyslainko@gmail.com
see you soon.

Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Data Persistence in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. What happens if the OpenTelemetry collector ...

Introducing Splunk 10.0: Smarter, Faster, and More Powerful Than Ever

Now On Demand Whether you're managing complex deployments or looking to future-proof your data ...

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...