Splunk Search

How to replace the string with the other string in a token?

poorni_p
Explorer

I have a multiselect fied with $team_name$ with Team A, Team B, Team C fields

If I select Team A and Team B in multiselect field

| table Date Day $team_name$ | **where** team_name =**replace** "Team A" **with** " Mark pet, george g" | **replace** "Team B" **with** "breande k , silk"

the required output table is

          Date      Day         Mark pet       george g       breande k     Silk
         26/9       thur        Day                  AF            night     day   
         27/9       fri        night              leave             night     day
         28/8       sat      night                 day              day       day

Please advise

0 Karma

renjith_nair
Legend

@poorni_p,

You could set the values directly in the input

  <fieldset submitButton="false">
    <input type="multiselect" token="team_name">
      <label>Teams</label>
      <choice value="Mark pet,george g">Team A</choice>
      <choice value="breande k , silk">Team B</choice>
      <choice value="Team C">Team C</choice>
    </input>
  </fieldset>

For some reasons if this doesnt work for you, you could use the change event as well

    <input type="multiselect" token="team_name">
      <label>Teams</label>
      <choice value="Mark pet,george g">Team A</choice>
      <choice value="breande k , silk">Team B</choice>
      <choice value="Team C">Team C</choice>
      <change>
        <condition label="Team A">
          <set token="your token name">your token value</set>
        </condition>
        .....other conditions....
      </change>
    </input>

Reference : https://docs.splunk.com/Documentation/Splunk/7.3.0/Viz/tokens

---
What goes around comes around. If it helps, hit it with Karma 🙂
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

.conf25 Global Broadcast: Don’t Miss a Moment

Hello Splunkers, .conf25 is only a click away.  Not able to make it to .conf25 in person? No worries, you can ...

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...