Splunk Search
Highlighted

Help with Splunk 6.3 Simple XML text input box: condition match regex IP address

Builder

I am trying to test a text input box value to determine if an IP address was provided. If an IP address was provided, I want to set the token "test-result" to IsanIP. If an IP address is not provided I want to set the token "test-result" to IsNOTan_IP.

I have tried the test using simple string tests and the dashboard works without issue. When I try to do the regex/IP test, it does not work.

I do not have enough karma to post links to the documentation.

Below is my Simple XML:

<form>
  <label>Test_IP</label>
  <fieldset>
    <input type="text" token="field100">
      <change>
        <condition match="match(value, "\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}")">
          <set token="test-result">Is_an_IP</set>
        </condition>
        <condition>
          <set token="test-result">Is_NOT_an_IP</set>
        </condition>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <title>Test-Result=$test-result$ field=$field100$</title>
        <search>
          <query>index=**</query>
          <earliest>0</earliest>
        </search>
      </table>
    </panel>
  </row>
</form>
Highlighted

Re: Help with Splunk 6.3 Simple XML text input box: condition match regex IP address

Builder

just noticed the posting process interpreted my double quote ascii value. I'm trying to break the interpretation by inserting spaces ...condition match="match(value, & quot ;d{1,3}.d{1,3}.d{1,3}.d{1,3}& quot ;)">

0 Karma
Highlighted

Re: Help with Splunk 6.3 Simple XML text input box: condition match regex IP address

SplunkTrust
SplunkTrust

If you indent each line of your XML 4 spaces, the editor will preserve special characters. I made the change for you.

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Highlighted

Re: Help with Splunk 6.3 Simple XML text input box: condition match regex IP address

SplunkTrust
SplunkTrust

Have you tried escaping the quotes inside your match command?

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Highlighted

Re: Help with Splunk 6.3 Simple XML text input box: condition match regex IP address

Builder

I'm using the ascii text for quotes in my xml. The posting process interpreted them and is displaying the quotes. I introduced spaces in to the ascii text and they do not get interpreted ... match="match(value, & quot ;d{1,3}.d{1,3}.d{1,3}.d{1,3}& quot ;)">

0 Karma
Highlighted

Re: Help with Splunk 6.3 Simple XML text input box: condition match regex IP address

SplunkTrust
SplunkTrust

I'm suggesting you should try match(value, \"\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\").

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Highlighted

Re: Help with Splunk 6.3 Simple XML text input box: condition match regex IP address

Builder

The dashboard tool will not save with that syntax.
"Encountered the following error while trying to update: In handler 'views': Error parsing XML on line 15: Extra content at the end of the document "

0 Karma
Highlighted

Re: Help with Splunk 6.3 Simple XML text input box: condition match regex IP address

Builder

Thanks for the edit!

0 Karma
Highlighted

Re: Help with Splunk 6.3 Simple XML text input box: condition match regex IP address

Community Manager
Community Manager

Hi @mydog8it (just got the cleverness of your username after typing it out ;P)

Just so you know, you're welcome to post the URL to docs you're referring to, even without enough karma. They won't render as links, but at least people can see exactly what page(s) you're referring to or copy and paste it themselves.

Cheers!
Patrick

0 Karma
Highlighted

Re: Help with Splunk 6.3 Simple XML text input box: condition match regex IP address

Builder

Thanks Patrick!
Here is the path to Evaluation Functions documentation:
http://docs.splunk.com/Documentation/Splunk/6.2.5/SearchReference/CommonEvalFunctions
do a find for "match(SUBJECT, "REGEX")"

Here is the path to the v6.3 Simple XML reference docs:
http://docs.splunk.com/Documentation/Splunk/latest/Viz/PanelreferenceforSimplifiedXML
do a find for "match"

0 Karma