Can you reference a token value inside a token eval tag?

[johnraftery]

Hello, I have a token called range (assume it has a value of "123-456"), and I am trying to use it inside a token eval:

<eval token="start">replace($range$,"-.*","")</eval>

So start should have a value of "123". But when I run it, $start$ is not defined.
The replace works fine if I hard-code the range value like this:

<eval token="start">replace("123-456","-.*","")</eval>

Any help much appreciated!
John

[aljohnson_splun · Accepted solution]

Single quotes !

<eval token="start">replace('range',"-.*","")</eval>

[Cuyose]

Odd, I can't get this to work worth anything. I am using a click.name2 value and attempting to edit it and nothing I do actually edits the token.

<eval token="parsedError">replace($click.name2$, "^[\d-{0,3}]", "")</eval>

[pmelon]

I'm struggling with this too. Code is:

<eval token="eventTime_epoch">strptime('eventTime',"%d/%m/%y %H:%M")</eval>

If I replace eventTime with 01/01/19 21:21 I get a proper epoch time. eventTime is never expanded within the tags. I am stuck.

[johnraftery]

Lovely, thanks very much. It also seems to work with no quotes, ie replace(range,"-.*","")

[aljohnson_splun]

Single quote however are mentioned here: http://docs.splunk.com/Documentation/Splunk/6.3.3/SearchReference/Eval

[aljohnson_splun]

http://docs.splunk.com/Documentation/Splunk/6.3.3/Viz/tokens#Define_token_filtering_and_formatting