I'm trying to set a token with eval. However, my logic doesn't seem to be working. I haven't been able to find a working example in the docs or from Answers, so a nudge in the right direction would be appreciated
<input type="text" token="stuff"> <label>test</label> <default>bband</default> <change> <eval token="stuff">replace($stuff$, ",", " OR ACCOUNT_NO=")</eval> </change> </input>
Have also tried using
' chars instead of
Did you get this to work? My eval token is only replacing the first occurence too. On 6.5.1 with the following where I try to change:
index=bla OR index=foo
<input type="multiselect" token="tenant_indexes" depends="$multi_tenancy$"> <change> <eval token="tenant_indexes_filter">replace(replace(tenant_indexes,"index=","")," OR ",",")</eval> </change> <label>Tenant</label> <fieldForLabel>tenant_name</fieldForLabel> <fieldForValue>index</fieldForValue> <search> <query>| `get_tenants_for_user_role($env:user$)`</query> </search> <default>index=*</default> <delimiter> OR </delimiter> <choice value="index=*">All</choice> </input>
I'm not sure of all of the details of the result you are trying to create with "eval" and a token. In case it helps, "eval" expressions in dashboards do use the same syntax as SPL "eval", but there are some exceptions to their behavior and usage (including the regular expression library). See:
for notes on how dashboard "eval" differs from SPL eval:
Also, have you seen the eval example in the Dashboard Examples App?
Hope this helps,
Yeah I think differences between the SPL eval and XML eval is what is causing different results.
Anyways thanks @frobinsonsplunk and @aljohnsonsplunk for your time and advice
I have used eval previously to straighten out a user input and then normalize the data. My case was, user enters a MAC address (Since it users, could be in any of the know MAC address formats), so we assigned the entry to a token, then applied eval to format it to our comfort. This was done in the search though. Just posting it in hope that it will give you some more ideas
[search index=blah | eval MacAddress=$MAC|s$|eval MAC=replace(MacAddress,"([-:\.])","")|return MAC]| wrapped in a subsearch which finally feeds the normalized MAC back to parent search.
Even i am facing the related issue.
<condition field="_raw"> <set token="serv">$serv$</set> <set token="src">$row.source$</set> <eval token="srcEval">rtrim('src',"_txn_log")</eval> <set token="uri">$row.uri$</set> <set token="_raw">$click.value2$</set> </condition>
I am trying to set token(srcEval) by using eval command..but it is not working ...Could you help ??