- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi, I have a token as below in my dashboard,
<set token="mySource">replace($numSuffix$,"_","")</set>
and I have another token utilising the above,
<set token="source">$indexg$ connection $mySource"</set>
In Query I have,
<search>
<query>$source$ | timechart count by host </query>
</search>
Unfortunately this is not working, In splunk section query, its not evaluating.
Its reflecting as,
index=xer connection replace(_45t66,"_","") | timechart count by host
I tried with
<set token="mySource">replace($numSuffix|s$,"_","")</set>
But its of no use.
Can someone help me with this?
Thanks.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Try using eval rather than set
<eval token="mySource">replace($numSuffix$,"_","")</eval>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you so much for the response and yes it worked.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Try using eval rather than set
<eval token="mySource">replace($numSuffix$,"_","")</eval>
