Dashboards & Visualizations

How to use the first Input Token in the second Input

digitalX
Explorer

Hi Comunity
I have some problem with input token in XML forms. The following code is working:

<form>
  <label>Update IP Blacklist</label>
  <description>Expired Bsp.: 60m, 24h, 8d, 2w, 1mon</description>
  <fieldset submitButton="true" autoRun="true">   
    <input type="text" token="Expired">
      <default>2w</default>
    </input>
    <input type="text" token="CLIENT_IP">
      <suffix>" | eval CLIENT_IP_BLACKLIST = 1 | eval CLIENT_IP_BLACKLIST_EXPIRY = relative_time(now(), "+2w") |...
...

and the following code does not: (the difference is at the end. I replaced the "+2w" with $Expired$)

<form>
  <label>Update IP Blacklist</label>
  <description>Expired Bsp.: 60m, 24h, 8d, 2w, 1mon</description>
  <fieldset submitButton="true" autoRun="true">   
    <input type="text" token="Expired">
      <default>2w</default>
    </input>
    <input type="text" token="CLIENT_IP">
      <suffix>" | eval CLIENT_IP_BLACKLIST = 1 | eval CLIENT_IP_BLACKLIST_EXPIRY = relative_time(now(), "$Expired$") |...
...

After I replaced that, I get the Error: "Unbalanced quotes." on the Dashboard. I tried it also with $Expired$ (without quotes) and $Expired|s$. Allways the same.

Has anyone a hint for me?

Tags (3)
1 Solution

gyslainlatsa
Motivator

hi digital,

in the next line, you forget to write the + before $Expired$

<suffix>" | eval CLIENT_IP_BLACKLIST = 1 | eval CLIENT_IP_BLACKLIST_EXPIRY = relative_time(now(), "$Expired$") |...

So here's what you need to write

 <suffix>" | eval CLIENT_IP_BLACKLIST = 1 | eval CLIENT_IP_BLACKLIST_EXPIRY = relative_time(now(), "+$Expired$") |...

and then tries to execute to get the result.
I waiting your remarks to see if it functioning
please forgive my english,

View solution in original post

gyslainlatsa
Motivator

hi digital,

in the next line, you forget to write the + before $Expired$

<suffix>" | eval CLIENT_IP_BLACKLIST = 1 | eval CLIENT_IP_BLACKLIST_EXPIRY = relative_time(now(), "$Expired$") |...

So here's what you need to write

 <suffix>" | eval CLIENT_IP_BLACKLIST = 1 | eval CLIENT_IP_BLACKLIST_EXPIRY = relative_time(now(), "+$Expired$") |...

and then tries to execute to get the result.
I waiting your remarks to see if it functioning
please forgive my english,

digitalX
Explorer

Yes, it works. Thank you very much! It was so clear, but I was too close in it... was searching on the wrong places.
Your english is perfect for me and my understanding, coming from switzerland. 🙂

gyslainlatsa
Motivator

hi digitalx,
thank you for your compliment, I coming from Cameroon but I work online to a resident of the USA,
we can work together to later if you wish, to help each other together in case of difficulties, here is my email: gyslainko@gmail.com
see you soon.

Get Updates on the Splunk Community!

App Platform's 2025 Year in Review: A Year of Innovation, Growth, and Community

As we step into 2026, it’s the perfect moment to reflect on what an extraordinary year 2025 was for the Splunk ...

Operationalizing Entity Risk Score with Enterprise Security 8.3+

Overview Enterprise Security 8.3 introduces a powerful new feature called “Entity Risk Scoring” (ERS) for ...

Unlock Database Monitoring with Splunk Observability Cloud

  In today’s fast-paced digital landscape, even minor database slowdowns can disrupt user experiences and ...