Splunk Search

Trim braces from a token variable-Dynamic dashboards

rczone
Path Finder

Im creating link to different dashboards based on the application clicked on from the main form

So i have a variable $sig.team$ which is basically selecting team with token prefix as ( and suffix as )as these are needed for my search queries

so now im linking to different dashboards based on the team selected,,,so i have defined a custom url with parameters like below:

/app/search/$sigteam$_Events_TESTl?form.issuetype=$click.value$&form.time.earliest=$earliest$&form.time.latest=$latest$&form.sigteam=$sigteam$&form.host=*

but when i click that the $sigteam$ resolving to (TESTAPP) instead of TESTAPP because of pre-fix and suffix like below:

/app/search/(TESTAPP)_Events_TESTl?form.issuetype=$click.value$&form.time.earliest=$earliest$&form.time.latest=$latest$&form.sigteam=$sigteam$&form.host=*

But i need the output URL as :

/app/search/TESTAPP_Events_TESTl?form.issuetype=$click.value$&form.time.earliest=$earliest$&form.time.latest=$latest$&form.sigteam=$sigteam$&form.host=*

Any feedback is welcome...Please suggest how to trim these braces in this scenario

1 Solution

woodcock
Esteemed Legend

Add this above the drilldown:

<eval token="sigteam">rtrim(ltrim($sigteam$, "("), ")")</eval>

View solution in original post

woodcock
Esteemed Legend

Add this above the drilldown:

<eval token="sigteam">rtrim(ltrim($sigteam$, "("), ")")</eval>
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...