Is there a way to use Regex (Regular Expressions) to limit digits in a search Panel?

[erogers]

Hi, I am working on a dashboard that will allow me to search up a store and it will give me data on that store. I am trying to limit my store search input panel to only allow 4 digits in it. I know the Regex (Regular Expressions) code for that is /d/d/d/d however, I am unsure how to implement that into my store search input panel.

          <input type="text" token="Store_num">
            <label>Store number</label>
          </input>
          <input type="time">
            <label>Time</label>
            <default>
              <earliest>-24h@h</earliest>
              <latest>now</latest>
            </default>
          </input>

This is what I have so far, using my Token value $Store_num$ allows me to change the panels on my dashboard to all the same Store. I don't know a whole lot about Splunk, but a co-worker mentioned maybe using a condition in my source could accomplish what I need, but after googling and searching Splunk Answers, I couldn't find what I wanted.

Please let me know if you need more information or if this can even be done. Thanks Splunk Community!

[thambisetty]

Hi,

you may not get what you are looking for using simple XML. you need to have jquery in js file which should be used in dashboard to allow only four digits in the input field.

[DalJeanis · Accepted solution]

Okay, I'm not sure exactly what you are asking, but here's a couple of answers.

1) Supposing that you have a field store_in where the number is 123, and you want to pad it on the left with zeroes.

 | eval store_out=substr("0000".store_in,len(store_in)+1,4)

The above code will also work if the number may be 12345, and you want to take only the RIGHTMOST 4 digits.

2) If when the number is 5-digits or more, you want to take the LEFTMOST 4 digits, then you need an if statement in there.

 | eval store_out=if(len(store_in)>4,substr(store_in,4),substr("0000".store_in,len(store_in)+1,4))

The above code should work in XML as well, just remember to replace > with > and so on.

---

Perhaps the simplest method for making it work against an input is to have the <change> for the input calculate a second token, and use that second token in the search, but that's a personal preference.

[FrankVl]

I read his question as that he is looking for input restriction / validation for a text input on a dashboard. (for which I am not aware of any way to do that in Splunk).

You might be able to do this using javascript, but I wouldn't be able to provide any detailed instructions on that. If you want to try that, perhaps the following is a good starting point: https://answers.splunk.com/answers/586958/how-do-i-add-javascript-to-a-splunk-dashboard.html

[DalJeanis]

@FrankVI - If you think about it broadly, there's a way to do almost everything that isn't contradicting part of the underlying architecture. In this case, for example, you could have the input useits <change> section to do the same validation and set a token with the validated value to be used.

It might also be possible to have it update the input with the desired value, but I'd have to test and verify that the specific method of updating did not create a race condition.

However, setting a different token, and displaying it, is not a problem.