Dashboards & Visualizations

Modifying a token within the dashboard

rsokolova
Path Finder

Thanks in advance. I have a token which there is a need to use for lower and upper case, I can get the lower case by default but how can I also transform that into uppercase in the condition.

      <label>House</label>
      <fieldForLabel>USERNAME</fieldForLabel>
      <fieldForValue>lower</fieldForValue>
      <search>
        <query>| inputlookup WMS_ACTIVE_SCHEMAS.csv | table USERNAME | rex field=USERNAME "(?P<USERNAME>\w{3}).*" | eval lower=lower(USERNAME) 
|eval lower = case(lower=="lub" , "LB1",lower=="grp" , "GP1", lower=="saa" , "SA1", lower=="hou" , "HO1", lower!="*", lower)
        <earliest>-24h@h</earliest>
        <latest>now</latest>
         <finalized >
                     <condition match=" 'job.resultCount' != 0">
                             **<set token="house_upper">[| eval upper($house$)]</set>**
                         </condition>
           </finalized >       
      </search>
      <default></default>
    </input>
0 Karma
1 Solution

niketnilay
Legend

@rsokolova try the following. Refer to Splunk documentation for using eval in dashboard (also some of its limitations) https://docs.splunk.com/Documentation/Splunk/latest/Viz/tokens#Define_token_filtering_and_formatting

<eval token="house_upper">upper("$house$")</eval>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketnilay
Legend

@rsokolova try the following. Refer to Splunk documentation for using eval in dashboard (also some of its limitations) https://docs.splunk.com/Documentation/Splunk/latest/Viz/tokens#Define_token_filtering_and_formatting

<eval token="house_upper">upper("$house$")</eval>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!