Splunk Search

How do you add a custom eval function or a macro to a custom app search?

christophercorb
New Member

Hi,

I am currently struggling with a problem. I am implementing custom views within a custom app that has one input field as text. That field can contain a URL. When submitting the form, I trigger 3 different searches in dashboards. Problem — some searches only need the hostname, while others need the complete URL. So I did research on that and was able to achieve a solution that I consider a dirty/bad one. I added some javascript and a second token, hook into the submit button click and extract the hostname out of the given URL and set the new token with that value. There are some timing problems as well.

There are several macros/functions available like md5() or len(). So I was wondering if it was possible to add a custom function - something like "index=* sourcetype=whatever TERM(extract_host($url$))" where extract_host calls a Python function that takes the token as an input and returns a new string that replaces the function call in the search ,and after that, the search is executed.

Or something like "eval host=extract_host($url$) | index=* sourcetype=whatever TERM(host)" ?

I could not find a way to solve that problem other than using a very bad javascript solution. Any ideas?

Thanks in advance.

0 Karma

woodcock
Esteemed Legend

Like this:

<eval token="my_host">replace(replace($url$, "Prefix RegEx Here", null()), "Suffix RegEx Here", null())</eval>
0 Karma

christophercorb
New Member

Hey. Thanks for your answer. The replace part works when I try it in the search , but with "" instead of null().

But where do I have to put the line in the simple xml tree? I tried it in >/change> but it does not work. I then tried a statement in the change child and that worked. So could you or anyone provide a full example please?

I could not find anything helpful in the splunk documentation or website.

<eval token="my_host">replace(replace($url$, "(https:\/\/|http:\/\/)?", ""), "\/(.*)", "")</eval>
0 Karma

woodcock
Esteemed Legend

You can put it just about anywhere. The most common are between <preview>...</preview>, ...and ... `.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...