Splunk Search
Highlighted

Trim or replace a Token value in Dashboard

Explorer

Im creating link to different dashboards based on the application clicked on from the main form

So i have a token variable $sig.team$ which is basically selecting team from drop down

so now im linking to different dashboards based on the team selected,,,so i have defined a custom url with parameters like below:

 /app/search/$sigteam$_Events_TEST?form.issuetype=$click.value$&form.time.earliest=$earliest$&form.time.latest=$latest$&form.sigteam=$sigteam$&form.host=*

One of the team defined has spaces : Test Team
so when you select this the $sig.team$ token value is Test Team (with space)

and the URL is resolving to

/app/search/Test%20%Team_Events_TEST?form.issuetype=$click.value$&form.time.earliest=$earliest$&form.time.latest=$latest$&form.sigteam=$sigteam$&form.host=*

But My backend Dashboard id wont accept spaces so i have created as TestTeam(with No spaces) but the URL is not resolving as it has no spaces

Is there any way that we can remove the space in the token $sig.team$ when only "Test Team" is selected in backend XML with eval and replace?

Need is we have to check if the selected team is " Test Team" then only delete the space and rename as TestTeam and assign to $sig.team$

Any feedback is welcome...Please suggest how to trim these braces in this scenario

Tried: But no luck

  <eval token="sigteam">trim($supgrpemail$)</eval>
0 Karma
Highlighted

Re: Trim or replace a Token value in Dashboard

SplunkTrust
SplunkTrust

I think you have the right idea with eval token, however the trim function removes characters from the ends rather than the middle. Try <eval token="sigteam">replace($supgrpemail$, " ", "")</eval>.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma
Highlighted

Re: Trim or replace a Token value in Dashboard

Esteemed Legend

You are doing something else wrong and barking up the wrong tree. The drilldown will first do a substitution of all tokens, then it will URL-encode the entire string so that spaces in tokens will turn into %20 encodings which your browser very well understands. When I was having mysterious problems like yours it turns out that the destination dashboard had multilple stacked form inputs A, B, and C, and it was setup so that whenever A changed, it unset inputs B and C and similarly whenever B changed, it unset inputC. This design is actually the correct approach when your dashboard is NOT a drilldown destination because it keeps impossible/wrong valueas for B and C from being input. However, it means that your dashboard can never be a drilldown destination for values of B and C. Check for this and remove the unsets.

0 Karma