Splunk Search

Trim or replace a Token value in Dashboard

rczone
Path Finder

Im creating link to different dashboards based on the application clicked on from the main form

So i have a token variable $sig.team$ which is basically selecting team from drop down

so now im linking to different dashboards based on the team selected,,,so i have defined a custom url with parameters like below:

 /app/search/$sigteam$_Events_TEST?form.issuetype=$click.value$&form.time.earliest=$earliest$&form.time.latest=$latest$&form.sigteam=$sigteam$&form.host=*

One of the team defined has spaces : Test Team
so when you select this the $sig.team$ token value is Test Team (with space)

and the URL is resolving to

/app/search/Test%20%Team_Events_TEST?form.issuetype=$click.value$&form.time.earliest=$earliest$&form.time.latest=$latest$&form.sigteam=$sigteam$&form.host=*

But My backend Dashboard id wont accept spaces so i have created as TestTeam(with No spaces) but the URL is not resolving as it has no spaces

Is there any way that we can remove the space in the token $sig.team$ when only "Test Team" is selected in backend XML with eval and replace?

Need is we have to check if the selected team is " Test Team" then only delete the space and rename as TestTeam and assign to $sig.team$

Any feedback is welcome...Please suggest how to trim these braces in this scenario

Tried: But no luck

  <eval token="sigteam">trim($supgrpemail$)</eval>
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

I think you have the right idea with eval token, however the trim function removes characters from the ends rather than the middle. Try <eval token="sigteam">replace($supgrpemail$, " ", "")</eval>.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

woodcock
Esteemed Legend

You are doing something else wrong and barking up the wrong tree. The drilldown will first do a substitution of all tokens, then it will URL-encode the entire string so that spaces in tokens will turn into %20 encodings which your browser very well understands. When I was having mysterious problems like yours it turns out that the destination dashboard had multilple stacked form inputs A, B, and C, and it was setup so that whenever A changed, it unset inputs B and C and similarly whenever B changed, it unset inputC. This design is actually the correct approach when your dashboard is NOT a drilldown destination because it keeps impossible/wrong valueas for B and C from being input. However, it means that your dashboard can never be a drilldown destination for values of B and C. Check for this and remove the unsets.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I think you have the right idea with eval token, however the trim function removes characters from the ends rather than the middle. Try <eval token="sigteam">replace($supgrpemail$, " ", "")</eval>.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...