replace function for eval token problem

[evelenke]

Hi Splunkers,

I was stuck with cutting the part of string for drilldown value from a chart using the <eval token>.
So I have values with names divided by symbol with other values and I need to have only the first part in output for drilldown page.
Obviously this won't work:

<eval token="fullName">replace('click.value',"(^[^\;]+)(.+)","\1")</eval>

And here's workaround :

mvindex(split($click.value$, ";"),0)

But here's question - is it planned to provide support for replace function for eval token.
And also can someone please provide a JS interpret of replace function for this case, because I've tried so much but with no success.

[gesman_splunk]

The problem seems to be that in:

replace(XXX,"(y)(z)", "\1\2")

The

"\1\2"

 construct is not supported within SimpleXML.
However try to replace it with:

"$1$2"

Gleb

[niketn]

I also think that there is an issue with this particular functionality of replace which does not seems to work for eval in Simple XML. Following Search works in Splunk Search

| makeresults 
| eval fullname="Jason;Smith"
| eval FirstName=replace(fullname,"(^[^\;]+)(.+)","\1")

Following is snippet from Simple XML (to recreate the issue), which does not work.

      <chart>
        <title>Clicked Value=$tokFirstName$</title>
        <search>
          <query>| makeresults 
| eval fullname="Jason;Smith"
| stats count by fullname</query>
          <earliest>-1m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <drilldown>
          <eval token="tokFirstName">replace('click.value',"(^[^\;]+)(.+)","\1")</eval>
        </drilldown>

[woodcock]

Using replace in an eval token is very common and should work just fine as documented here, among many other places:

https://answers.splunk.com/answers/452922/how-to-use-the-replace-command-to-modify-a-regex-t.html