Dashboards & Visualizations

Manipulate a Token String in a Form

Engager

I would like to modify the token a user inputs in a form using rex commands so that I can insert it into the search later. For instance, if the user enters AC123,AC456 in the form field, I would want that to be plugged into the search as 'AC123','AC456'. Is there anyway to do this?

<input type="text" token="account" searchWhenChanged="false">
  <label>Account</label>
  <default>AC123,AC456</default>
</input>
Tags (2)
1 Solution

SplunkTrust
SplunkTrust

This should be doable using an eval-based macro. For example, if you wanted to turn a token containing "error,warn" into "error OR warn" you can run this search:

index=_internal `commasToOr("error,warn")`

using this eval-based macro definition:

[commasToOr(1)]
args = token
definition = replace("$token$", ",", " OR ")
iseval = 1

Looking at the job inspector, the search that was actually executed is this:

search index=_internal error OR warn

You can apply the same strategy to adding single quotes using replace, and this should work from your form as well.

View solution in original post

SplunkTrust
SplunkTrust

This should be doable using an eval-based macro. For example, if you wanted to turn a token containing "error,warn" into "error OR warn" you can run this search:

index=_internal `commasToOr("error,warn")`

using this eval-based macro definition:

[commasToOr(1)]
args = token
definition = replace("$token$", ",", " OR ")
iseval = 1

Looking at the job inspector, the search that was actually executed is this:

search index=_internal error OR warn

You can apply the same strategy to adding single quotes using replace, and this should work from your form as well.

View solution in original post

SplunkTrust
SplunkTrust

You can do the manipulation within the search itself where you'll be using it. E.g. (assuming you use search filter using token like account=$account$

index=abc sourcetype=xyz [search index=abc | head 1 | eval account="'$account$'" | table account | eval account=replace(account,",","','")]...

0 Karma