Splunk Search

Can you reference a token value inside a token eval tag?

Communicator

Hello, I have a token called range (assume it has a value of "123-456"), and I am trying to use it inside a token eval:

<eval token="start">replace($range$,"-.*","")</eval>

So start should have a value of "123". But when I run it, $start$ is not defined.
The replace works fine if I hard-code the range value like this:

<eval token="start">replace("123-456","-.*","")</eval>

Any help much appreciated!
John

1 Solution

Splunk Employee
Splunk Employee

Single quotes !

<eval token="start">replace('range',"-.*","")</eval>

View solution in original post

Splunk Employee
Splunk Employee

Single quotes !

<eval token="start">replace('range',"-.*","")</eval>

View solution in original post

Builder

Odd, I can't get this to work worth anything. I am using a click.name2 value and attempting to edit it and nothing I do actually edits the token.

<eval token="parsedError">replace($click.name2$, "^[\d-{0,3}]", "")</eval>
0 Karma

Explorer

I'm struggling with this too. Code is:

<eval token="eventTime_epoch">strptime('eventTime',"%d/%m/%y %H:%M")</eval>

If I replace eventTime with 01/01/19 21:21 I get a proper epoch time. eventTime is never expanded within the tags. I am stuck.

0 Karma

Communicator

Lovely, thanks very much. It also seems to work with no quotes, ie replace(range,"-.*","")

Splunk Employee
Splunk Employee
0 Karma