Dashboards & Visualizations

Manipulate a Token String in a Form

mjosen
Engager

I would like to modify the token a user inputs in a form using rex commands so that I can insert it into the search later. For instance, if the user enters AC123,AC456 in the form field, I would want that to be plugged into the search as 'AC123','AC456'. Is there anyway to do this?

<input type="text" token="account" searchWhenChanged="false">
  <label>Account</label>
  <default>AC123,AC456</default>
</input>
Tags (2)
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

This should be doable using an eval-based macro. For example, if you wanted to turn a token containing "error,warn" into "error OR warn" you can run this search:

index=_internal `commasToOr("error,warn")`

using this eval-based macro definition:

[commasToOr(1)]
args = token
definition = replace("$token$", ",", " OR ")
iseval = 1

Looking at the job inspector, the search that was actually executed is this:

search index=_internal error OR warn

You can apply the same strategy to adding single quotes using replace, and this should work from your form as well.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

This should be doable using an eval-based macro. For example, if you wanted to turn a token containing "error,warn" into "error OR warn" you can run this search:

index=_internal `commasToOr("error,warn")`

using this eval-based macro definition:

[commasToOr(1)]
args = token
definition = replace("$token$", ",", " OR ")
iseval = 1

Looking at the job inspector, the search that was actually executed is this:

search index=_internal error OR warn

You can apply the same strategy to adding single quotes using replace, and this should work from your form as well.

somesoni2
Revered Legend

You can do the manipulation within the search itself where you'll be using it. E.g. (assuming you use search filter using token like account=$account$

index=abc sourcetype=xyz [search index=abc | head 1 | eval account="'$account$'" | table account | eval account=replace(account,",","','")]...

0 Karma
Get Updates on the Splunk Community!

Monitoring MariaDB and MySQL

In a previous post, we explored monitoring PostgreSQL and general best practices around which metrics to ...

Financial Services Industry Use Cases, ITSI Best Practices, and More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Splunk Federated Analytics for Amazon Security Lake

Thursday, November 21, 2024  |  11AM PT / 2PM ET Register Now Join our session to see the technical ...