Splunk Search

Trim or replace a Token value in Dashboard

rczone
Path Finder

Im creating link to different dashboards based on the application clicked on from the main form

So i have a token variable $sig.team$ which is basically selecting team from drop down

so now im linking to different dashboards based on the team selected,,,so i have defined a custom url with parameters like below:

 /app/search/$sigteam$_Events_TEST?form.issuetype=$click.value$&form.time.earliest=$earliest$&form.time.latest=$latest$&form.sigteam=$sigteam$&form.host=*

One of the team defined has spaces : Test Team
so when you select this the $sig.team$ token value is Test Team (with space)

and the URL is resolving to

/app/search/Test%20%Team_Events_TEST?form.issuetype=$click.value$&form.time.earliest=$earliest$&form.time.latest=$latest$&form.sigteam=$sigteam$&form.host=*

But My backend Dashboard id wont accept spaces so i have created as TestTeam(with No spaces) but the URL is not resolving as it has no spaces

Is there any way that we can remove the space in the token $sig.team$ when only "Test Team" is selected in backend XML with eval and replace?

Need is we have to check if the selected team is " Test Team" then only delete the space and rename as TestTeam and assign to $sig.team$

Any feedback is welcome...Please suggest how to trim these braces in this scenario

Tried: But no luck

  <eval token="sigteam">trim($supgrpemail$)</eval>
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

I think you have the right idea with eval token, however the trim function removes characters from the ends rather than the middle. Try <eval token="sigteam">replace($supgrpemail$, " ", "")</eval>.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

woodcock
Esteemed Legend

You are doing something else wrong and barking up the wrong tree. The drilldown will first do a substitution of all tokens, then it will URL-encode the entire string so that spaces in tokens will turn into %20 encodings which your browser very well understands. When I was having mysterious problems like yours it turns out that the destination dashboard had multilple stacked form inputs A, B, and C, and it was setup so that whenever A changed, it unset inputs B and C and similarly whenever B changed, it unset inputC. This design is actually the correct approach when your dashboard is NOT a drilldown destination because it keeps impossible/wrong valueas for B and C from being input. However, it means that your dashboard can never be a drilldown destination for values of B and C. Check for this and remove the unsets.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I think you have the right idea with eval token, however the trim function removes characters from the ends rather than the middle. Try <eval token="sigteam">replace($supgrpemail$, " ", "")</eval>.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...