Splunk Search

replace function for eval token problem

evelenke
Contributor

Hi Splunkers,

I was stuck with cutting the part of string for drilldown value from a chart using the <eval token>.
So I have values with names divided by symbol with other values and I need to have only the first part in output for drilldown page.
Obviously this won't work:

<eval token="fullName">replace('click.value',"(^[^\;]+)(.+)","\1")</eval>

And here's workaround :

mvindex(split($click.value$, ";"),0)

But here's question - is it planned to provide support for replace function for eval token.
And also can someone please provide a JS interpret of replace function for this case, because I've tried so much but with no success.

0 Karma

gesman_splunk
Splunk Employee
Splunk Employee

The problem seems to be that in:

 

replace(XXX,"(y)(z)", "\1\2")

 

The

 

"\1\2"

 

 construct is not supported within SimpleXML.
However try to replace it with:

 

"$1$2"

 

Gleb

Tags (3)

niketn
Legend

I also think that there is an issue with this particular functionality of replace which does not seems to work for eval in Simple XML. Following Search works in Splunk Search

| makeresults 
| eval fullname="Jason;Smith"
| eval FirstName=replace(fullname,"(^[^\;]+)(.+)","\1")

Following is snippet from Simple XML (to recreate the issue), which does not work.

      <chart>
        <title>Clicked Value=$tokFirstName$</title>
        <search>
          <query>| makeresults 
| eval fullname="Jason;Smith"
| stats count by fullname</query>
          <earliest>-1m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <drilldown>
          <eval token="tokFirstName">replace('click.value',"(^[^\;]+)(.+)","\1")</eval>
        </drilldown>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

woodcock
Esteemed Legend

Using replace in an eval token is very common and should work just fine as documented here, among many other places:

https://answers.splunk.com/answers/452922/how-to-use-the-replace-command-to-modify-a-regex-t.html

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...