Dashboards & Visualizations

How to use the first Input Token in the second Input

digitalX
Explorer

Hi Comunity
I have some problem with input token in XML forms. The following code is working:

<form>
  <label>Update IP Blacklist</label>
  <description>Expired Bsp.: 60m, 24h, 8d, 2w, 1mon</description>
  <fieldset submitButton="true" autoRun="true">   
    <input type="text" token="Expired">
      <default>2w</default>
    </input>
    <input type="text" token="CLIENT_IP">
      <suffix>" | eval CLIENT_IP_BLACKLIST = 1 | eval CLIENT_IP_BLACKLIST_EXPIRY = relative_time(now(), "+2w") |...
...

and the following code does not: (the difference is at the end. I replaced the "+2w" with $Expired$)

<form>
  <label>Update IP Blacklist</label>
  <description>Expired Bsp.: 60m, 24h, 8d, 2w, 1mon</description>
  <fieldset submitButton="true" autoRun="true">   
    <input type="text" token="Expired">
      <default>2w</default>
    </input>
    <input type="text" token="CLIENT_IP">
      <suffix>" | eval CLIENT_IP_BLACKLIST = 1 | eval CLIENT_IP_BLACKLIST_EXPIRY = relative_time(now(), "$Expired$") |...
...

After I replaced that, I get the Error: "Unbalanced quotes." on the Dashboard. I tried it also with $Expired$ (without quotes) and $Expired|s$. Allways the same.

Has anyone a hint for me?

Tags (3)
1 Solution

gyslainlatsa
Motivator

hi digital,

in the next line, you forget to write the + before $Expired$

<suffix>" | eval CLIENT_IP_BLACKLIST = 1 | eval CLIENT_IP_BLACKLIST_EXPIRY = relative_time(now(), "$Expired$") |...

So here's what you need to write

 <suffix>" | eval CLIENT_IP_BLACKLIST = 1 | eval CLIENT_IP_BLACKLIST_EXPIRY = relative_time(now(), "+$Expired$") |...

and then tries to execute to get the result.
I waiting your remarks to see if it functioning
please forgive my english,

View solution in original post

gyslainlatsa
Motivator

hi digital,

in the next line, you forget to write the + before $Expired$

<suffix>" | eval CLIENT_IP_BLACKLIST = 1 | eval CLIENT_IP_BLACKLIST_EXPIRY = relative_time(now(), "$Expired$") |...

So here's what you need to write

 <suffix>" | eval CLIENT_IP_BLACKLIST = 1 | eval CLIENT_IP_BLACKLIST_EXPIRY = relative_time(now(), "+$Expired$") |...

and then tries to execute to get the result.
I waiting your remarks to see if it functioning
please forgive my english,

digitalX
Explorer

Yes, it works. Thank you very much! It was so clear, but I was too close in it... was searching on the wrong places.
Your english is perfect for me and my understanding, coming from switzerland. 🙂

gyslainlatsa
Motivator

hi digitalx,
thank you for your compliment, I coming from Cameroon but I work online to a resident of the USA,
we can work together to later if you wish, to help each other together in case of difficulties, here is my email: gyslainko@gmail.com
see you soon.

Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...