Dashboards & Visualizations

Manipulate a Token String in a Form

mjosen
Engager

I would like to modify the token a user inputs in a form using rex commands so that I can insert it into the search later. For instance, if the user enters AC123,AC456 in the form field, I would want that to be plugged into the search as 'AC123','AC456'. Is there anyway to do this?

<input type="text" token="account" searchWhenChanged="false">
  <label>Account</label>
  <default>AC123,AC456</default>
</input>
Tags (2)
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

This should be doable using an eval-based macro. For example, if you wanted to turn a token containing "error,warn" into "error OR warn" you can run this search:

index=_internal `commasToOr("error,warn")`

using this eval-based macro definition:

[commasToOr(1)]
args = token
definition = replace("$token$", ",", " OR ")
iseval = 1

Looking at the job inspector, the search that was actually executed is this:

search index=_internal error OR warn

You can apply the same strategy to adding single quotes using replace, and this should work from your form as well.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

This should be doable using an eval-based macro. For example, if you wanted to turn a token containing "error,warn" into "error OR warn" you can run this search:

index=_internal `commasToOr("error,warn")`

using this eval-based macro definition:

[commasToOr(1)]
args = token
definition = replace("$token$", ",", " OR ")
iseval = 1

Looking at the job inspector, the search that was actually executed is this:

search index=_internal error OR warn

You can apply the same strategy to adding single quotes using replace, and this should work from your form as well.

somesoni2
Revered Legend

You can do the manipulation within the search itself where you'll be using it. E.g. (assuming you use search filter using token like account=$account$

index=abc sourcetype=xyz [search index=abc | head 1 | eval account="'$account$'" | table account | eval account=replace(account,",","','")]...

0 Karma
Get Updates on the Splunk Community!

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...

Improve Data Pipelines Using Splunk Data Management

  Register Now   This Tech Talk will explore the pipeline management offerings Edge Processor and Ingest ...

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud?

Register Join this Tech Talk to learn how unique features like Service Centric Views, Tag Spotlight, and ...