Dashboards & Visualizations

Modifying a token within the dashboard

rsokolova
Path Finder

Thanks in advance. I have a token which there is a need to use for lower and upper case, I can get the lower case by default but how can I also transform that into uppercase in the condition.

      <label>House</label>
      <fieldForLabel>USERNAME</fieldForLabel>
      <fieldForValue>lower</fieldForValue>
      <search>
        <query>| inputlookup WMS_ACTIVE_SCHEMAS.csv | table USERNAME | rex field=USERNAME "(?P<USERNAME>\w{3}).*" | eval lower=lower(USERNAME) 
|eval lower = case(lower=="lub" , "LB1",lower=="grp" , "GP1", lower=="saa" , "SA1", lower=="hou" , "HO1", lower!="*", lower)
        <earliest>-24h@h</earliest>
        <latest>now</latest>
         <finalized >
                     <condition match=" 'job.resultCount' != 0">
                             **<set token="house_upper">[| eval upper($house$)]</set>**
                         </condition>
           </finalized >       
      </search>
      <default></default>
    </input>
0 Karma
1 Solution

niketnilay
Legend

@rsokolova try the following. Refer to Splunk documentation for using eval in dashboard (also some of its limitations) https://docs.splunk.com/Documentation/Splunk/latest/Viz/tokens#Define_token_filtering_and_formatting

<eval token="house_upper">upper("$house$")</eval>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketnilay
Legend

@rsokolova try the following. Refer to Splunk documentation for using eval in dashboard (also some of its limitations) https://docs.splunk.com/Documentation/Splunk/latest/Viz/tokens#Define_token_filtering_and_formatting

<eval token="house_upper">upper("$house$")</eval>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

sjbriggs
Path Finder

FWIW,

I had to remove the quotes from the second part, otherwise I was setting the value of the new token to the name of the other token, not the value.

<eval token="tok_rig_lower">lower($tok_rig$)</eval>

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...