Splunk Search

How to modify a dashboard input token before passing to a search

Geep
Engager

Is it possible to modify the value of a token obtained from a dashboard input prior to it being used in a panel? In the scenario that I have a domain value is input to have various searches executed on it. Sometimes the domain is provided to the users in a "sanitized" format to avoid clicking of links. The "." is replaced with "[.]". I want to give the users the option of inputting domains in either format, sanitized or not, and having the token value rewritten to remove the square brackets, something akin to | replace "[.]" WITH "." IN $domain$ The dashboard was created in the Classic format. I have been unable to figure out how I might modify the dashboard source to eval or modify the value into the consistent formatting. One of the things I tried was to add an <eval> tag in the source to evaluate the token into a new token value and leverage a replace command to modify it in the process but got a message stating "Invalid child="eval" is not allowed in node="dashboard"" So if an <eval> tag is the solution I am not sure where to put it. Does anyone have insight on how I might achieve this token modification cleanly?

0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

Use a change stanza in the input, e.g.

<input type="text" token="pre_domain">
...
  <change>
    <eval token="actual_domain">replace($pre_domain$,"\\[\\.\\]",".")</eval>  </change>
</input>

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

Use a change stanza in the input, e.g.

<input type="text" token="pre_domain">
...
  <change>
    <eval token="actual_domain">replace($pre_domain$,"\\[\\.\\]",".")</eval>  </change>
</input>

Geep
Engager

Thank you for this answer. It is perfect. I had a lot of the right code, I just did not know how to use the <change> tag correctly. It works exactly as I envisioned.

0 Karma
Get Updates on the Splunk Community!

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...

Splunk AppDynamics Agents Webinar Series

Mark your calendars! On June 24th at 12PM PST, we’re going live with the second session of our Splunk ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...