Getting Data In

In Dashboard: Remove Underscore in token

Splunkmm
Engager

Hi, I have a token as below in my dashboard,

                  <set token="mySource">replace($numSuffix$,"_","")</set>

and I have another token utilising the above,

                 <set token="source">$indexg$ connection $mySource"</set>

In Query I have,
                   <search>

                         <query>$source$ | timechart count by host </query>
                 </search>

Unfortunately this is not working, In splunk section query, its not evaluating.

Its reflecting as,

                           index=xer connection replace(_45t66,"_","") | timechart count by host

I tried with 
                         <set token="mySource">replace($numSuffix|s$,"_","")</set>
But its of no use.

Can someone help me with this? 

Thanks.

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try using eval rather than set

<eval token="mySource">replace($numSuffix$,"_","")</eval>

View solution in original post

Splunkmm
Engager

Thank you so much for the response and yes it worked.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try using eval rather than set

<eval token="mySource">replace($numSuffix$,"_","")</eval>
Get Updates on the Splunk Community!

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...

Announcing the Migration of the Splunk Add-on for Microsoft Azure Inputs to ...

Announcing the Migration of the Splunk Add-on for Microsoft Azure Inputs to Officially Supported Splunk ...