I was stuck with cutting the part of string for drilldown value from a chart using the
So I have values with names divided by symbol with other values and I need to have only the first part in output for drilldown page.
Obviously this won't work:
And here's workaround :
But here's question - is it planned to provide support for replace function for eval token.
And also can someone please provide a JS interpret of replace function for this case, because I've tried so much but with no success.
replace in an eval token is very common and should work just fine as documented here, among many other places:
I also think that there is an issue with this particular functionality of replace which does not seems to work for eval in Simple XML. Following Search works in Splunk Search
| makeresults | eval fullname="Jason;Smith" | eval FirstName=replace(fullname,"(^[^\;]+)(.+)","\1")
Following is snippet from Simple XML (to recreate the issue), which does not work.
<chart> <title>Clicked Value=$tokFirstName$</title> <search> <query>| makeresults | eval fullname="Jason;Smith" | stats count by fullname</query> <earliest>-1m</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <drilldown> <eval token="tokFirstName">replace('click.value',"(^[^\;]+)(.+)","\1")</eval> </drilldown>