Splunk Search

Trim or replace a Token value in Dashboard

rczone
Path Finder

Im creating link to different dashboards based on the application clicked on from the main form

So i have a token variable $sig.team$ which is basically selecting team from drop down

so now im linking to different dashboards based on the team selected,,,so i have defined a custom url with parameters like below:

 /app/search/$sigteam$_Events_TEST?form.issuetype=$click.value$&form.time.earliest=$earliest$&form.time.latest=$latest$&form.sigteam=$sigteam$&form.host=*

One of the team defined has spaces : Test Team
so when you select this the $sig.team$ token value is Test Team (with space)

and the URL is resolving to

/app/search/Test%20%Team_Events_TEST?form.issuetype=$click.value$&form.time.earliest=$earliest$&form.time.latest=$latest$&form.sigteam=$sigteam$&form.host=*

But My backend Dashboard id wont accept spaces so i have created as TestTeam(with No spaces) but the URL is not resolving as it has no spaces

Is there any way that we can remove the space in the token $sig.team$ when only "Test Team" is selected in backend XML with eval and replace?

Need is we have to check if the selected team is " Test Team" then only delete the space and rename as TestTeam and assign to $sig.team$

Any feedback is welcome...Please suggest how to trim these braces in this scenario

Tried: But no luck

  <eval token="sigteam">trim($supgrpemail$)</eval>
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

I think you have the right idea with eval token, however the trim function removes characters from the ends rather than the middle. Try <eval token="sigteam">replace($supgrpemail$, " ", "")</eval>.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

woodcock
Esteemed Legend

You are doing something else wrong and barking up the wrong tree. The drilldown will first do a substitution of all tokens, then it will URL-encode the entire string so that spaces in tokens will turn into %20 encodings which your browser very well understands. When I was having mysterious problems like yours it turns out that the destination dashboard had multilple stacked form inputs A, B, and C, and it was setup so that whenever A changed, it unset inputs B and C and similarly whenever B changed, it unset inputC. This design is actually the correct approach when your dashboard is NOT a drilldown destination because it keeps impossible/wrong valueas for B and C from being input. However, it means that your dashboard can never be a drilldown destination for values of B and C. Check for this and remove the unsets.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I think you have the right idea with eval token, however the trim function removes characters from the ends rather than the middle. Try <eval token="sigteam">replace($supgrpemail$, " ", "")</eval>.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

A Four-Part Event Series: Full Stack Observability For the AI Era

As AI reshapes applications, infrastructure, and the way teams operate, the traditional boundaries of ...

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Event Series: Level up your SOC: Advancing with Splunk Enterprise Security

AI has fundamentally raised the stakes for security operations, and this three-part series is your guide to ...