ValuePrefix and ValueSuffix for Text input

vinaykataaig · ‎07-18-2019

Hi Team,

Can anyone help me resolve the Value Prefix and Value Suffix for Text Box input. It says value prefix and value suffix is not allowed here. Attached is the screenshot of my XML.
It is working perfect when I use the same Value Prefix and Value Suffix for Multi select Input.

vnravikumar · ‎07-22-2019

Hi

Try this

[updated]:

<form>
  <label>textinput</label>
  <fieldset submitButton="false">
    <input type="text" token="field1" searchWhenChanged="true">
      <label>field1</label>
      <change>
        <eval token="temp">replace($value$,"\"","") </eval>
      </change>
    </input>
    <input type="dropdown" token="tokText" searchWhenChanged="true" depends="$hide$">
      <label>field2</label>
      <fieldForLabel>token</fieldForLabel>
      <fieldForValue>token</fieldForValue>
      <search>
        <query>| makeresults 
| eval token="$temp$"
| makemv delim="," token 
| eval token = trim(token) 
| mvexpand token 
| eval token = "ServerName=\"".token."\"" 
| mvcombine token delim=" OR " 
| nomv token |table token</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
      <selectFirstChoice>true</selectFirstChoice>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <title>$form.tokText$</title>
        <search>
          <query/>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="count">10</option>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</form>

Final value is in token tokText

niketn · ‎07-18-2019

@vinaykataaig please try the following approach using <change> event handler for Splunk text input and using <eval> set the required token with Prefix and Suffix as per your needs (in the following example you can print $tokText$ and confirm).

  <fieldset submitButton="false">
    <input type="text" token="field1" searchWhenChanged="true">
      <label>field1</label>
      <change>
        <eval token="tokText">"ServerName=\"*".$value$."*\""</eval>
      </change>
    </input>
  </fieldset>

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

vinaykataaig · ‎07-22-2019

@niketnilay Thanks for responding, Can you prolong your example a little more, Your response is working for single value in Text input, But I am trying to make it work for several input values.

Ex: With in text input if I copy and paste 100 Server names from any spreadsheet, I need all of them to be covered with delimiter like
"Server1", "Server2", "Server3", "Server4", ...

niketn · ‎07-22-2019

@vinaykataaig I had given above snippet as per the code you had in your question assuming you wanted * in the prefix and suffix. If you want to perform complicated replacements you would need to use an independent search the way @vnravikumar has shared. However, here is a simpler approach:

  <search>
    <query>|  makeresults
| eval selectedText="$tokText$" 
| eval formattedText="\"".replace(selectedText,"\s","\",\"")."\""
    </query>
    <progress>
      <set token="tokSelectedText">$result.selectedText$</set>
      <set token="tokFormattedText">$result.formattedText$</set>
    </progress>
  </search>

Following is the run anywhere example (Copy paste the content from Excel to the text box to test):

<form>
  <label>Text Box format input copied from Excel</label>
  <fieldset submitButton="false">
    <input type="text" token="tokText">
      <label>Copy Paste values from Excel</label>
    </input>
  </fieldset>
  <search>
    <query>|  makeresults
| eval selectedText="$tokText$" 
| eval formattedText="\"".replace(selectedText,"\s","\",\"")."\""
    </query>
    <progress>
      <set token="tokSelectedText">$result.selectedText$</set>
      <set token="tokFormattedText">$result.formattedText$</set>
    </progress>
  </search>
  <row>
    <panel>
      <html>
        <div>
          Value of token passed from Text Box (<code>tokSelectedText</code>): <b>$tokSelectedText$</b>
        </div>
        <div>
          Formatted token as per requirement (<code>tokFormattedText</code>): <b>$tokFormattedText$</b>
        </div>
      </html>
    </panel>
  </row>
</form>

PS: The values in Excel should not have spaces for this to work as regular expression \s matches any whitespace character.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

ValuePrefix and ValueSuffix for Text input

Can’t make it to .conf25? Join us online!

Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform

Calling All Security Pros: Ready to Race Through Boston?

Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...

Are you a member of the Splunk Community?

ValuePrefix and ValueSuffix for Text input

Can’t make it to .conf25? Join us online!

Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform

Calling All Security Pros: Ready to Race Through Boston?

Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...