Splunk Search

How do you add a custom eval function or a macro to a custom app search?

christophercorb
New Member

Hi,

I am currently struggling with a problem. I am implementing custom views within a custom app that has one input field as text. That field can contain a URL. When submitting the form, I trigger 3 different searches in dashboards. Problem — some searches only need the hostname, while others need the complete URL. So I did research on that and was able to achieve a solution that I consider a dirty/bad one. I added some javascript and a second token, hook into the submit button click and extract the hostname out of the given URL and set the new token with that value. There are some timing problems as well.

There are several macros/functions available like md5() or len(). So I was wondering if it was possible to add a custom function - something like "index=* sourcetype=whatever TERM(extract_host($url$))" where extract_host calls a Python function that takes the token as an input and returns a new string that replaces the function call in the search ,and after that, the search is executed.

Or something like "eval host=extract_host($url$) | index=* sourcetype=whatever TERM(host)" ?

I could not find a way to solve that problem other than using a very bad javascript solution. Any ideas?

Thanks in advance.

0 Karma

woodcock
Esteemed Legend

Like this:

<eval token="my_host">replace(replace($url$, "Prefix RegEx Here", null()), "Suffix RegEx Here", null())</eval>
0 Karma

christophercorb
New Member

Hey. Thanks for your answer. The replace part works when I try it in the search , but with "" instead of null().

But where do I have to put the line in the simple xml tree? I tried it in >/change> but it does not work. I then tried a statement in the change child and that worked. So could you or anyone provide a full example please?

I could not find anything helpful in the splunk documentation or website.

<eval token="my_host">replace(replace($url$, "(https:\/\/|http:\/\/)?", ""), "\/(.*)", "")</eval>
0 Karma

woodcock
Esteemed Legend

You can put it just about anywhere. The most common are between <preview>...</preview>, ...and ... `.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Unlock What’s Next: The Splunk Cloud Platform at .conf25

In just a few days, Boston will be buzzing as the Splunk team and thousands of community members come together ...