Splunk Search

replace function for eval token problem


Hi Splunkers,

I was stuck with cutting the part of string for drilldown value from a chart using the <eval token>.
So I have values with names divided by symbol with other values and I need to have only the first part in output for drilldown page.
Obviously this won't work:

<eval token="fullName">replace('click.value',"(^[^\;]+)(.+)","\1")</eval>

And here's workaround :

mvindex(split($click.value$, ";"),0)

But here's question - is it planned to provide support for replace function for eval token.
And also can someone please provide a JS interpret of replace function for this case, because I've tried so much but with no success.

0 Karma

Re: replace function for eval token problem

Esteemed Legend

Using replace in an eval token is very common and should work just fine as documented here, among many other places:


0 Karma

Re: replace function for eval token problem


I also think that there is an issue with this particular functionality of replace which does not seems to work for eval in Simple XML. Following Search works in Splunk Search

| makeresults 
| eval fullname="Jason;Smith"
| eval FirstName=replace(fullname,"(^[^\;]+)(.+)","\1")

Following is snippet from Simple XML (to recreate the issue), which does not work.

        <title>Clicked Value=$tokFirstName$</title>
          <query>| makeresults 
| eval fullname="Jason;Smith"
| stats count by fullname</query>
          <eval token="tokFirstName">replace('click.value',"(^[^\;]+)(.+)","\1")</eval>

| eval message="Happy Splunking!!!"

0 Karma