Splunk Search
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
Ask a Question
Solved! Jump to solution

Replace Function when used in token eval does not behave as in search

gdiogo
Explorer
‎11-02-2017 06:40 AM

I simply wish to prove that point since it wasn't quite established in the several topics I have read about this problem.
(In case you were condering, I use Splunk 6.4.1)
The replace function used in eval to evaluate a token DOES NOT BEHAVE accordingly to what it is supposed to do (which is successfully conducted in the search...) !

THERE IS A HUGE DISCREPANCY BETWEEN REPLACE USED IN A EVAL MADE IN SEARCH VS ONE MADE IN BASIC XML EVAL TAGS

So here it is :
(Try it, it is quite compelling)
This is quite evidently a major dysfunction !!

<form>
  <label>Test</label>
  <description>Test</description>
  <fieldset submitButton="false">
    <input type="text" token="test.input" searchWhenChanged="true">
      <label>test Input</label>
      <change>
        <eval token="test.input.processed">replace(replace(replace(replace(lower($value$), "[^0-9a-f]", ""), "(..)(.{1,2})", "\1-\2"), "([^\-]{2})([^\-]{1,2})", "\1-\2"), "(.{17}).*", "\1")</eval>
        <eval token="test.input.processed_more_simple">replace(lower($value$), "[^0-9a-f]", "")</eval>
      </change>
      <default>ac23ghzz</default>
    </input>
  </fieldset>
  <row>
    <html>
      Input : $test.input$ &lt;br/&gt;
      Result of eval Token : $test.input.processed$   &lt;br/&gt;
      Result of simplified eval Token : $test.input.processed_more_simple$   &lt;br/&gt;
    </html>
  </row>
  <row>
    <panel>
      <table>
        <title>Test Regex</title>
        <search>
          <query>| gentimes start=-1 | eval input = "$test.input$" | fields input | eval "Simplified Result" = replace(lower(input), "[^0-9a-f]", "") | eval result = replace(replace(replace(replace(lower(input), "[^0-9a-f]", ""), "(..)(.{1,2})", "\1-\2"), "([^\-]{2})([^\-]{1,2})", "\1-\2"), "(.{17}).*", "\1")</query>
          <earliest>0</earliest>
          <latest></latest>
        </search>
        <option name="wrap">undefined</option>
        <option name="rowNumbers">undefined</option>
        <option name="drilldown">row</option>
        <option name="dataOverlayMode">none</option>
        <option name="count">10</option>
      </table>
    </panel>
  </row>
</form>

So appart from trying to report this issue, I strongly hope for someone to be able to give me a tip and give me a way to accomplish successfully this functionnality with the current state of things.

Thanks in advance 🙂

0 Karma
Reply
1 Solution
Solved! Jump to solution
Solution

gdiogo
Explorer
‎11-02-2017 07:42 AM

After thinking about it, a quite obvious solution is to use a hidden select to run the actual search that I knew worked haha 🙂
So I guess I didn't need to complain about this ! 🙂
Well anyway, in case it is usefull for someone :

<form>
  <label>Test</label>
  <description>Test</description>
  <fieldset submitButton="false">
    <input type="text" token="test.input" searchWhenChanged="true">
      <label>test Input</label>
      <change>
        <eval token="test.input.processed">replace(replace(replace(replace(lower($value$), "[^0-9a-f]", ""), "(..)(.{1,2})", "\1-\2"), "([^\-]{2})([^\-]{1,2})", "\1-\2"), "(.{17}).*", "\1")</eval>
        <eval token="test.input.processed_more_simple">replace(lower($value$), "[^0-9a-f]", "")</eval>
        <unset token="form.hidden.test.input"></unset><!-- To select first choice anew ! 😉 -->
      </change>
      <default>ac23ghzz</default>
    </input>
    <input type="dropdown" token="hidden.test.input" depends="$never_shown$" searchWhenChanged="true">
      <label>Hidden</label>
      <selectFirstChoice>true</selectFirstChoice>
      <search>
        <query>| makeresults | eval input = "$form.test.input$" | fields input | eval "Simplified Result" = replace(lower(input), "[^0-9a-f]", "") | eval result = replace(replace(replace(replace(lower(input), "[^0-9a-f]", ""), "(..)(.{1,2})", "\1-\2"), "([^\-]{2})([^\-]{1,2})", "\1-\2"), "(.{17}).*", "\1") | eval final_result ='Simplified Result'.";".result</query>
      </search>
      <fieldForLabel>final_result</fieldForLabel>
      <fieldForValue>final_result</fieldForValue>
      <change>
        <eval token="test.workinginput.processed">mvindex(split($value$, ";"), 0)</eval>
        <eval token="test.workinginput.processed_more_simple">mvindex(split($value$, ";"), 1)</eval>
      </change>
    </input>
  </fieldset>
  <row>
    <html>
       Input : $test.input$ .......................
       Result of eval Token : $test.input.processed$ .......................
       Result of simplified eval Token : $test.input.processed_more_simple$ .......................
       Result of simplified eval Token through trick : $test.workinginput.processed$ .......................
       Result of eval Token through trick : $test.workinginput.processed_more_simple$ .......................
     </html>
  </row>
  <row>
    <panel>
      <table>
        <title>Test Regex</title>
        <search>
          <query>| makeresults | eval input = "$test.input$" | table input | eval "Simplified Result" = replace(lower(input), "[^0-9a-f]", "") | eval result = replace(replace(replace(replace(lower(input), "[^0-9a-f]", ""), "(..)(.{1,2})", "\1-\2"), "([^\-]{2})([^\-]{1,2})", "\1-\2"), "(.{17}).*", "\1")</query>
          <earliest>0</earliest>
          <latest></latest>
        </search>
        <option name="wrap">undefined</option>
        <option name="rowNumbers">undefined</option>
        <option name="drilldown">row</option>
        <option name="dataOverlayMode">none</option>
        <option name="count">10</option>
      </table>
    </panel>
  </row>
</form>

View solution in original post

0 Karma
Reply
Solved! Jump to solution
Solution

gdiogo
Explorer
‎11-02-2017 07:42 AM

After thinking about it, a quite obvious solution is to use a hidden select to run the actual search that I knew worked haha 🙂
So I guess I didn't need to complain about this ! 🙂
Well anyway, in case it is usefull for someone :

<form>
  <label>Test</label>
  <description>Test</description>
  <fieldset submitButton="false">
    <input type="text" token="test.input" searchWhenChanged="true">
      <label>test Input</label>
      <change>
        <eval token="test.input.processed">replace(replace(replace(replace(lower($value$), "[^0-9a-f]", ""), "(..)(.{1,2})", "\1-\2"), "([^\-]{2})([^\-]{1,2})", "\1-\2"), "(.{17}).*", "\1")</eval>
        <eval token="test.input.processed_more_simple">replace(lower($value$), "[^0-9a-f]", "")</eval>
        <unset token="form.hidden.test.input"></unset><!-- To select first choice anew ! 😉 -->
      </change>
      <default>ac23ghzz</default>
    </input>
    <input type="dropdown" token="hidden.test.input" depends="$never_shown$" searchWhenChanged="true">
      <label>Hidden</label>
      <selectFirstChoice>true</selectFirstChoice>
      <search>
        <query>| makeresults | eval input = "$form.test.input$" | fields input | eval "Simplified Result" = replace(lower(input), "[^0-9a-f]", "") | eval result = replace(replace(replace(replace(lower(input), "[^0-9a-f]", ""), "(..)(.{1,2})", "\1-\2"), "([^\-]{2})([^\-]{1,2})", "\1-\2"), "(.{17}).*", "\1") | eval final_result ='Simplified Result'.";".result</query>
      </search>
      <fieldForLabel>final_result</fieldForLabel>
      <fieldForValue>final_result</fieldForValue>
      <change>
        <eval token="test.workinginput.processed">mvindex(split($value$, ";"), 0)</eval>
        <eval token="test.workinginput.processed_more_simple">mvindex(split($value$, ";"), 1)</eval>
      </change>
    </input>
  </fieldset>
  <row>
    <html>
       Input : $test.input$ .......................
       Result of eval Token : $test.input.processed$ .......................
       Result of simplified eval Token : $test.input.processed_more_simple$ .......................
       Result of simplified eval Token through trick : $test.workinginput.processed$ .......................
       Result of eval Token through trick : $test.workinginput.processed_more_simple$ .......................
     </html>
  </row>
  <row>
    <panel>
      <table>
        <title>Test Regex</title>
        <search>
          <query>| makeresults | eval input = "$test.input$" | table input | eval "Simplified Result" = replace(lower(input), "[^0-9a-f]", "") | eval result = replace(replace(replace(replace(lower(input), "[^0-9a-f]", ""), "(..)(.{1,2})", "\1-\2"), "([^\-]{2})([^\-]{1,2})", "\1-\2"), "(.{17}).*", "\1")</query>
          <earliest>0</earliest>
          <latest></latest>
        </search>
        <option name="wrap">undefined</option>
        <option name="rowNumbers">undefined</option>
        <option name="drilldown">row</option>
        <option name="dataOverlayMode">none</option>
        <option name="count">10</option>
      </table>
    </panel>
  </row>
</form>
0 Karma
Reply
Solved! Jump to solution

gdiogo
Explorer
‎11-02-2017 06:49 AM

Sorry for the mistake in formatting : in html tag, should be <br/>
:S

0 Karma
Reply
Get Updates on the Splunk Community!

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...