Dashboards & Visualizations

XML dashboard - modify a token using replace and regex

BernardEAI
Communicator

Hi

I'm trying to repeat the example for replace in the Splunk documentation, within a dashboard: (https://docs.splunk.com/Documentation/SplunkCloud/8.1.2009/SearchReference/TextFunctions)

I'm running this in a dashboard, triggered by a drilldown:

 

<drilldown>
 <eval token="p1_ttr_left">replace("1/14/2017", "^(\d{1,2})/(\d{1,2})/", "\2/\1/")</eval>
</drilldown>

 

It doesn't seem to work, nothing happens to the token (I'm writing it to the dashboard output).

Labels (1)
0 Karma

BernardEAI
Communicator

Thanks @richgalloway . This didn't work, still not replacing the token. In fact, the token remains as 

$p1_ttr_left$ in the dashboard.

If I run the following as a test, it seems to work and it performs the replace on the string and returns the token.

<eval token="p1_ttr_left">replace("www,aaa","^(.+?),","")</eval>

It looks to me like some forms of regex is accepted, but other (specifically if it includes a \..?) doesn't work.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The slashes need to be escaped.  Try

<eval token="p1_ttr_left">replace("1/14/2017", "^(\d{1,2})\/(\d{1,2})\/", "\2/\1/")</eval>
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...