How do you add a custom eval function or a macro to a custom app search?

[christophercorb]

Hi,

I am currently struggling with a problem. I am implementing custom views within a custom app that has one input field as text. That field can contain a URL. When submitting the form, I trigger 3 different searches in dashboards. Problem — some searches only need the hostname, while others need the complete URL. So I did research on that and was able to achieve a solution that I consider a dirty/bad one. I added some javascript and a second token, hook into the submit button click and extract the hostname out of the given URL and set the new token with that value. There are some timing problems as well.

There are several macros/functions available like md5() or len(). So I was wondering if it was possible to add a custom function - something like "index=* sourcetype=whatever TERM(extract_host($url$))" where extract_host calls a Python function that takes the token as an input and returns a new string that replaces the function call in the search ,and after that, the search is executed.

Or something like "eval host=extract_host($url$) | index=* sourcetype=whatever TERM(host)" ?

I could not find a way to solve that problem other than using a very bad javascript solution. Any ideas?

Thanks in advance.

[woodcock]

Like this:

<eval token="my_host">replace(replace($url$, "Prefix RegEx Here", null()), "Suffix RegEx Here", null())</eval>

[christophercorb]

Hey. Thanks for your answer. The replace part works when I try it in the search , but with "" instead of null().

But where do I have to put the line in the simple xml tree? I tried it in >/change> but it does not work. I then tried a statement in the change child and that worked. So could you or anyone provide a full example please?

I could not find anything helpful in the splunk documentation or website.

<eval token="my_host">replace(replace($url$, "(https:\/\/|http:\/\/)?", ""), "\/(.*)", "")</eval>

[woodcock]

You can put it just about anywhere. The most common are between <preview>...</preview>, ...and ... `.