Splunk Search

How to replace the string with the other string in a token?

poorni_p
Explorer

I have a multiselect fied with $team_name$ with Team A, Team B, Team C fields

If I select Team A and Team B in multiselect field

| table Date Day $team_name$ | **where** team_name =**replace** "Team A" **with** " Mark pet, george g" | **replace** "Team B" **with** "breande k , silk"

the required output table is

          Date      Day         Mark pet       george g       breande k     Silk
         26/9       thur        Day                  AF            night     day   
         27/9       fri        night              leave             night     day
         28/8       sat      night                 day              day       day

Please advise

0 Karma

renjith_nair
Legend

@poorni_p,

You could set the values directly in the input

  <fieldset submitButton="false">
    <input type="multiselect" token="team_name">
      <label>Teams</label>
      <choice value="Mark pet,george g">Team A</choice>
      <choice value="breande k , silk">Team B</choice>
      <choice value="Team C">Team C</choice>
    </input>
  </fieldset>

For some reasons if this doesnt work for you, you could use the change event as well

    <input type="multiselect" token="team_name">
      <label>Teams</label>
      <choice value="Mark pet,george g">Team A</choice>
      <choice value="breande k , silk">Team B</choice>
      <choice value="Team C">Team C</choice>
      <change>
        <condition label="Team A">
          <set token="your token name">your token value</set>
        </condition>
        .....other conditions....
      </change>
    </input>

Reference : https://docs.splunk.com/Documentation/Splunk/7.3.0/Viz/tokens

---
What goes around comes around. If it helps, hit it with Karma 🙂
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...