Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: Why is eval in my Simple XML not working to se...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Why is eval in my Simple XML not working to set and return certain token values?
I've been having trouble trying to strptime a timestamp entered as an input for a dashboard, and had gotten strange results, so I've backed up and have tried to test some of the XML functions with more simple cases to see where I'm going wrong.
Unfortunately, I've made some test cases as simple as I can make them, and still something is wrong with my evals. I just can't sort it out.
If I enter, say "giraffe" into my input for the form described below, the only token that returns is the $newname$ token. $uCase$ and $leno$ both return "null"
With my test evals being so short, it has to (has to has to) be something simple, but I can't figure it out.
Pliz halp.
<form>
<label>TimeTestTakeThree</label>
<fieldset submitButton="true">
<input type="text" token="newname">
<label>labelrino</label>
<default>giraffe</default>
<change>
<eval token="Ucase">upper('newname')</eval>
<eval token="leno">len('newname')</eval>
</change>
</input>
</fieldset>
<row>
<html>
<p>Raw Entry: <b>$newname$</b></p>
<p>Upper(raw):<b>$Ucase$</b></p>
<p>Length(raw): <b>$leno$</b></p>
</html>
</row>
</form>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I realise this is a post from 2016, but I noticed that the <input> uses a <default> value rather than the recommended <initial> value per the Splunk docs (for the current version of 8.2.3), which may help others while troubleshooting this or similar issues on newer Splunk versions.
https://docs.splunk.com/Documentation/Splunk/8.2.3/Viz/FormEditor#Configure_input_value_handling
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try using the built-in token value instead of newname in the change block.
<form>
<label>TimeTestTakeThree</label>
<fieldset submitButton="true">
<input type="text" token="newname">
<label>labelrino</label>
<default>giraffe</default>
<change>
<eval token="Ucase">upper('value')</eval>
<eval token="leno">len('value')</eval>
</change>
</input>
</fieldset>
<row>
<html>
<p>Raw Entry: <b>$newname$</b></p>
<p>Upper(raw):<b>$Ucase$</b></p>
<p>Length(raw): <b>$leno$</b></p>
</html>
</row>
</form>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi, did you manage to find a solution to this yet? I have almost exactly the same problem, only that using $tokenname$ or 'tokenname' doesn't give me anything (isn't replaced by token value) and just using tokenname without $ or ' only results in 0 or "null".
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try this:
<form>
<label>TimeTestTakeThree</label>
<fieldset submitButton="true">
<input type="text" token="newname">
<label>labelrino</label>
<default>giraffe</default>
<change>
<eval token="ucaseSetToken">upper('newname')</eval>
</change>
</input>
</fieldset>
<row>
<panel>
<html>
<p>upperSetToken:<b>$ucaseSetToken$</b></p>
</html>
</panel>
</row>
</form>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Correct the following in your change event handler
<change>
<eval token="Ucase">upper($newname$)</eval>
<eval token="leno">len($newname$)</eval>
</change>
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Tried already. Still comes back null.
<form>
<label>TimeTestTakeThree</label>
<fieldset submitButton="true">
<input type="text" token="newname">
<label>labelrino</label>
<default>giraffe</default>
<change>
<eval token="ucaseSetToken">upper($newname$)</eval>
</change>
</input>
</fieldset>
<row>
<html>
<p>upperSetToken:<b>$ucaseSetToken$</b></p>
</html>
</row>
</form>
Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain
Splunk Lantern’s Guide to The Most Popular .conf25 Sessions
Unlock What’s Next: The Splunk Cloud Platform at .conf25
