Splunk Search
Highlighted

replace function for eval token problem

Contributor

Hi Splunkers,

I was stuck with cutting the part of string for drilldown value from a chart using the <eval token>.
So I have values with names divided by symbol with other values and I need to have only the first part in output for drilldown page.
Obviously this won't work:

<eval token="fullName">replace('click.value',"(^[^\;]+)(.+)","\1")</eval>

And here's workaround :

mvindex(split($click.value$, ";"),0)

But here's question - is it planned to provide support for replace function for eval token.
And also can someone please provide a JS interpret of replace function for this case, because I've tried so much but with no success.

0 Karma
Highlighted

Re: replace function for eval token problem

Esteemed Legend

Using replace in an eval token is very common and should work just fine as documented here, among many other places:

https://answers.splunk.com/answers/452922/how-to-use-the-replace-command-to-modify-a-regex-t.html

0 Karma
Highlighted

Re: replace function for eval token problem

Legend

I also think that there is an issue with this particular functionality of replace which does not seems to work for eval in Simple XML. Following Search works in Splunk Search

| makeresults 
| eval fullname="Jason;Smith"
| eval FirstName=replace(fullname,"(^[^\;]+)(.+)","\1")

Following is snippet from Simple XML (to recreate the issue), which does not work.

      <chart>
        <title>Clicked Value=$tokFirstName$</title>
        <search>
          <query>| makeresults 
| eval fullname="Jason;Smith"
| stats count by fullname</query>
          <earliest>-1m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <drilldown>
          <eval token="tokFirstName">replace('click.value',"(^[^\;]+)(.+)","\1")</eval>
        </drilldown>



| eval message="Happy Splunking!!!"


0 Karma