Splunk Search

How to modify a dashboard input token before passing to a search

Geep
Engager

Is it possible to modify the value of a token obtained from a dashboard input prior to it being used in a panel? In the scenario that I have a domain value is input to have various searches executed on it. Sometimes the domain is provided to the users in a "sanitized" format to avoid clicking of links. The "." is replaced with "[.]". I want to give the users the option of inputting domains in either format, sanitized or not, and having the token value rewritten to remove the square brackets, something akin to | replace "[.]" WITH "." IN $domain$ The dashboard was created in the Classic format. I have been unable to figure out how I might modify the dashboard source to eval or modify the value into the consistent formatting. One of the things I tried was to add an <eval> tag in the source to evaluate the token into a new token value and leverage a replace command to modify it in the process but got a message stating "Invalid child="eval" is not allowed in node="dashboard"" So if an <eval> tag is the solution I am not sure where to put it. Does anyone have insight on how I might achieve this token modification cleanly?

0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

Use a change stanza in the input, e.g.

<input type="text" token="pre_domain">
...
  <change>
    <eval token="actual_domain">replace($pre_domain$,"\\[\\.\\]",".")</eval>  </change>
</input>

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

Use a change stanza in the input, e.g.

<input type="text" token="pre_domain">
...
  <change>
    <eval token="actual_domain">replace($pre_domain$,"\\[\\.\\]",".")</eval>  </change>
</input>

Geep
Engager

Thank you for this answer. It is perfect. I had a lot of the right code, I just did not know how to use the <change> tag correctly. It works exactly as I envisioned.

0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  &#x1f680; Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...