Modifying a token within the dashboard

[rsokolova]

Thanks in advance. I have a token which there is a need to use for lower and upper case, I can get the lower case by default but how can I also transform that into uppercase in the condition.

      <label>House</label>
      <fieldForLabel>USERNAME</fieldForLabel>
      <fieldForValue>lower</fieldForValue>
      <search>
        <query>| inputlookup WMS_ACTIVE_SCHEMAS.csv | table USERNAME | rex field=USERNAME "(?P<USERNAME>\w{3}).*" | eval lower=lower(USERNAME) 
|eval lower = case(lower=="lub" , "LB1",lower=="grp" , "GP1", lower=="saa" , "SA1", lower=="hou" , "HO1", lower!="*", lower)
        <earliest>-24h@h</earliest>
        <latest>now</latest>
         <finalized >
                     <condition match=" 'job.resultCount' != 0">
                             **<set token="house_upper">[| eval upper($house$)]</set>**
                         </condition>
           </finalized >       
      </search>
      <default></default>
    </input>

[niketn · Accepted solution]

@rsokolova try the following. Refer to Splunk documentation for using eval in dashboard (also some of its limitations) https://docs.splunk.com/Documentation/Splunk/latest/Viz/tokens#Define_token_filtering_and_formatting

<eval token="house_upper">upper("$house$")</eval>

[sjbriggs]

FWIW,

I had to remove the quotes from the second part, otherwise I was setting the value of the new token to the name of the other token, not the value.

<eval token="tok_rig_lower">lower($tok_rig$)</eval>