Splunk Search

replace function for eval token problem

evelenke
Contributor

Hi Splunkers,

I was stuck with cutting the part of string for drilldown value from a chart using the <eval token>.
So I have values with names divided by symbol with other values and I need to have only the first part in output for drilldown page.
Obviously this won't work:

<eval token="fullName">replace('click.value',"(^[^\;]+)(.+)","\1")</eval>

And here's workaround :

mvindex(split($click.value$, ";"),0)

But here's question - is it planned to provide support for replace function for eval token.
And also can someone please provide a JS interpret of replace function for this case, because I've tried so much but with no success.

0 Karma

gesman_splunk
Splunk Employee
Splunk Employee

The problem seems to be that in:

 

replace(XXX,"(y)(z)", "\1\2")

 

The

 

"\1\2"

 

 construct is not supported within SimpleXML.
However try to replace it with:

 

"$1$2"

 

Gleb

Tags (3)

niketn
Legend

I also think that there is an issue with this particular functionality of replace which does not seems to work for eval in Simple XML. Following Search works in Splunk Search

| makeresults 
| eval fullname="Jason;Smith"
| eval FirstName=replace(fullname,"(^[^\;]+)(.+)","\1")

Following is snippet from Simple XML (to recreate the issue), which does not work.

      <chart>
        <title>Clicked Value=$tokFirstName$</title>
        <search>
          <query>| makeresults 
| eval fullname="Jason;Smith"
| stats count by fullname</query>
          <earliest>-1m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <drilldown>
          <eval token="tokFirstName">replace('click.value',"(^[^\;]+)(.+)","\1")</eval>
        </drilldown>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

woodcock
Esteemed Legend

Using replace in an eval token is very common and should work just fine as documented here, among many other places:

https://answers.splunk.com/answers/452922/how-to-use-the-replace-command-to-modify-a-regex-t.html

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...