Splunk Search

How to modify a dashboard input token before passing to a search

Geep
Engager

Is it possible to modify the value of a token obtained from a dashboard input prior to it being used in a panel? In the scenario that I have a domain value is input to have various searches executed on it. Sometimes the domain is provided to the users in a "sanitized" format to avoid clicking of links. The "." is replaced with "[.]". I want to give the users the option of inputting domains in either format, sanitized or not, and having the token value rewritten to remove the square brackets, something akin to | replace "[.]" WITH "." IN $domain$ The dashboard was created in the Classic format. I have been unable to figure out how I might modify the dashboard source to eval or modify the value into the consistent formatting. One of the things I tried was to add an <eval> tag in the source to evaluate the token into a new token value and leverage a replace command to modify it in the process but got a message stating "Invalid child="eval" is not allowed in node="dashboard"" So if an <eval> tag is the solution I am not sure where to put it. Does anyone have insight on how I might achieve this token modification cleanly?

0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

Use a change stanza in the input, e.g.

<input type="text" token="pre_domain">
...
  <change>
    <eval token="actual_domain">replace($pre_domain$,"\\[\\.\\]",".")</eval>  </change>
</input>

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

Use a change stanza in the input, e.g.

<input type="text" token="pre_domain">
...
  <change>
    <eval token="actual_domain">replace($pre_domain$,"\\[\\.\\]",".")</eval>  </change>
</input>

Geep
Engager

Thank you for this answer. It is perfect. I had a lot of the right code, I just did not know how to use the <change> tag correctly. It works exactly as I envisioned.

0 Karma
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...