Hey guys. I'm a beginner of Splunk
I have a one question.
I get a input value
but value has a space. so I want to remove it
here's my code
<input type="text" token="field55"> // field55 is 'temp token'
<lable>test </lable>
<change>
<eval token="field5"> trim($value$)</eval> // field5 is 'real token'
</change>
</input>
.....
<query>
index=mail mail_sender= "$field5$"
| table mail_sender
</query>
if I input like 'test123 ' the result value is 'test123' (no spaces)
how can I do that??
So sorry hard to read
please help me out!!
Isn't it possible to trim it in the search?
<form>
<label>Text Space</label>
<fieldset submitButton="false">
<input type="text" token="input">
<label>Input</label>
</input>
</fieldset>
<row>
<panel>
<table>
<search>
<query>|makeresults|eval acutal_text="$input$"|eval actal_length=len("$input$")|eval trimmed_text=trim(acutal_text)|eval trimmed_length=len(trimmed_text)</query>
<earliest>-15m</earliest>
<latest>now</latest>
</search>
<option name="drilldown">none</option>
</table>
</panel>
</row>
</form>
I have some files uploaded onto my splunk, but when I used spl like this (index=web sourcetype=access* status=200 product_name=* | table JSESSIONID,price,product_name), for example, I do not get any results.
What am I doing wrong?
My email is barbozaprince@gmail.com
Thank you for you answer. renjith_nair
If I input index field, Is it possible to use both Index and makeresults ?
@tkdguq0110 , that's just a run anywhere example with dummy data. So you can replace makeresults with your original search
Isn't it possible to trim it in the search?
<form>
<label>Text Space</label>
<fieldset submitButton="false">
<input type="text" token="input">
<label>Input</label>
</input>
</fieldset>
<row>
<panel>
<table>
<search>
<query>|makeresults|eval acutal_text="$input$"|eval actal_length=len("$input$")|eval trimmed_text=trim(acutal_text)|eval trimmed_length=len(trimmed_text)</query>
<earliest>-15m</earliest>
<latest>now</latest>
</search>
<option name="drilldown">none</option>
</table>
</panel>
</row>
</form>