Splunk Search

Trim or replace a Token value in Dashboard

rczone
Path Finder

Im creating link to different dashboards based on the application clicked on from the main form

So i have a token variable $sig.team$ which is basically selecting team from drop down

so now im linking to different dashboards based on the team selected,,,so i have defined a custom url with parameters like below:

 /app/search/$sigteam$_Events_TEST?form.issuetype=$click.value$&form.time.earliest=$earliest$&form.time.latest=$latest$&form.sigteam=$sigteam$&form.host=*

One of the team defined has spaces : Test Team
so when you select this the $sig.team$ token value is Test Team (with space)

and the URL is resolving to

/app/search/Test%20%Team_Events_TEST?form.issuetype=$click.value$&form.time.earliest=$earliest$&form.time.latest=$latest$&form.sigteam=$sigteam$&form.host=*

But My backend Dashboard id wont accept spaces so i have created as TestTeam(with No spaces) but the URL is not resolving as it has no spaces

Is there any way that we can remove the space in the token $sig.team$ when only "Test Team" is selected in backend XML with eval and replace?

Need is we have to check if the selected team is " Test Team" then only delete the space and rename as TestTeam and assign to $sig.team$

Any feedback is welcome...Please suggest how to trim these braces in this scenario

Tried: But no luck

  <eval token="sigteam">trim($supgrpemail$)</eval>
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

I think you have the right idea with eval token, however the trim function removes characters from the ends rather than the middle. Try <eval token="sigteam">replace($supgrpemail$, " ", "")</eval>.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

woodcock
Esteemed Legend

You are doing something else wrong and barking up the wrong tree. The drilldown will first do a substitution of all tokens, then it will URL-encode the entire string so that spaces in tokens will turn into %20 encodings which your browser very well understands. When I was having mysterious problems like yours it turns out that the destination dashboard had multilple stacked form inputs A, B, and C, and it was setup so that whenever A changed, it unset inputs B and C and similarly whenever B changed, it unset inputC. This design is actually the correct approach when your dashboard is NOT a drilldown destination because it keeps impossible/wrong valueas for B and C from being input. However, it means that your dashboard can never be a drilldown destination for values of B and C. Check for this and remove the unsets.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I think you have the right idea with eval token, however the trim function removes characters from the ends rather than the middle. Try <eval token="sigteam">replace($supgrpemail$, " ", "")</eval>.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

App Building 101 - Build Your First App!

WATCH RECORDING NOW   Tech Talk: App Dev Edition Splunk has tons of out-of-the-box functionality, and you’ve ...

Introducing support for Amazon Data Firehose in Splunk Edge Processor

We’re excited to announce a powerful update to Splunk Data Management with added support for Amazon Data ...

The Observability Round-Up: September 2024

What’s up Splunk Community! Welcome to the latest edition of the Observability Round-Up, a monthly series in ...