Hi, Splunkers,
I have the following token handler, if input "Gucid_token_with3handlers" is 2 digits number, it will return as token skillexpressionLength,
if it's not 2 digits number will return itself as token Gucid_token, which works fine.
now I want to add handler 3, if 1st 3 characters are VQ_, I want it to return itself as token Gucid_token_VQ, otherwise, it return as Gucid_token_VQ with value *
but it looks handler 3 is conflicting with handler 1.
so my question is how to define the 3rd token handler to have it work together 1st and 2nd token handlers without conflict?
the following is the input token definition with 3 token handlers.
<input type="text" token="Gucid_token_with3handlers" searchWhenChanged="true">
<label>Gucid/UUID/SID</label>
<change>
<eval token="Gucid_token"> if(match(value, "^[0-9][0-9]?$"),"", value)</eval>
<eval token="skillexpressionLength">if(match(value, "^[0-9][0-9]?$"),value, 0)</eval>
<eval token="Gucid_token_VQ">if(substr(value,1,3)=="VQ_"),value, *)</eval>
</change>
<default></default>
</input>
then I used the following search clause with $Gucid_token_VQ$
| search VQ = $Gucid_token_VQ$
then this search panel showing : search is waiting for input.
thx in advance.
Kevin
