Splunk Search

How to modify a dashboard input token before passing to a search

Geep
Engager

Is it possible to modify the value of a token obtained from a dashboard input prior to it being used in a panel? In the scenario that I have a domain value is input to have various searches executed on it. Sometimes the domain is provided to the users in a "sanitized" format to avoid clicking of links. The "." is replaced with "[.]". I want to give the users the option of inputting domains in either format, sanitized or not, and having the token value rewritten to remove the square brackets, something akin to | replace "[.]" WITH "." IN $domain$ The dashboard was created in the Classic format. I have been unable to figure out how I might modify the dashboard source to eval or modify the value into the consistent formatting. One of the things I tried was to add an <eval> tag in the source to evaluate the token into a new token value and leverage a replace command to modify it in the process but got a message stating "Invalid child="eval" is not allowed in node="dashboard"" So if an <eval> tag is the solution I am not sure where to put it. Does anyone have insight on how I might achieve this token modification cleanly?

0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

Use a change stanza in the input, e.g.

<input type="text" token="pre_domain">
...
  <change>
    <eval token="actual_domain">replace($pre_domain$,"\\[\\.\\]",".")</eval>  </change>
</input>

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

Use a change stanza in the input, e.g.

<input type="text" token="pre_domain">
...
  <change>
    <eval token="actual_domain">replace($pre_domain$,"\\[\\.\\]",".")</eval>  </change>
</input>

Geep
Engager

Thank you for this answer. It is perfect. I had a lot of the right code, I just did not know how to use the <change> tag correctly. It works exactly as I envisioned.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...