Dashboards & Visualizations

How to replace string in text input before search?

_smp_
Builder

I have a simple form where a user inputs a MAC address in the format AA:BB:CC:DD:EE:FF. But the field that I'm going to search contains MAC addresses in a different format: AA-BB-CC-DD-EE-FF. So what I need to do is replace semicolons with hyphens in the value of the token before I perform the search. The eval statement is simple enough:
| eval mac_address=replace("AA:BB:CC:DD:EE:FF",":","-")
But it's not clear to me if I can do this eval with form input, or if I need to construct my query to do the replacement before I run the search. But I couldn't make it work either way.

Labels (1)
Tags (2)
0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

You can have your text input to calculate the new token with formatted value and use the new token in your searches. Like this

....
 <input type="text" token="mac_tok">
      <label>Specify a log level</label>
      <default>INFO</default>
      <change>
         <eval token="mac_formatted">replace("$value$",":","-")</eval>
      </change>
    </input>
....

View solution in original post

woodcock
Esteemed Legend

Assuming that your input sets a token called mac_address_token1, try this:

<input type="text" token="mac_address_token1">
...
    <change>
        <eval token="mac_address_token2">replace($mac_address_token1$,":","-")</eval>     
    </change>
</intput>

Then use $mac_address_token2$ inside of your search

somesoni2
SplunkTrust
SplunkTrust

You can have your text input to calculate the new token with formatted value and use the new token in your searches. Like this

....
 <input type="text" token="mac_tok">
      <label>Specify a log level</label>
      <default>INFO</default>
      <change>
         <eval token="mac_formatted">replace("$value$",":","-")</eval>
      </change>
    </input>
....

mr_aksal
Engager

hi, pretty old topic, but that was also what I was lookin for. 

However I had to remove  quotes from this part to make it work

replace("$value$",

 

 

thanks!!

0 Karma

woodcock
Esteemed Legend

I am too slow again...

0 Karma

exocore123
Path Finder

Say I want to take in an input as index=index source=source filter=$inputfield$, and the input field just has a bunch of labels, but I want to map/replace the labels before the search actually happens, will this work in this case?

0 Karma

_smp_
Builder

Yes, that was the trick! I will need to study the <change> event handler doc. Thanks so much!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...