Thanks in advance. I have a token which there is a need to use for lower and upper case, I can get the lower case by default but how can I also transform that into uppercase in the condition.
<label>House</label>
<fieldForLabel>USERNAME</fieldForLabel>
<fieldForValue>lower</fieldForValue>
<search>
<query>| inputlookup WMS_ACTIVE_SCHEMAS.csv | table USERNAME | rex field=USERNAME "(?P<USERNAME>\w{3}).*" | eval lower=lower(USERNAME)
|eval lower = case(lower=="lub" , "LB1",lower=="grp" , "GP1", lower=="saa" , "SA1", lower=="hou" , "HO1", lower!="*", lower)
<earliest>-24h@h</earliest>
<latest>now</latest>
<finalized >
<condition match=" 'job.resultCount' != 0">
**<set token="house_upper">[| eval upper($house$)]</set>**
</condition>
</finalized >
</search>
<default></default>
</input>
@rsokolova try the following. Refer to Splunk documentation for using eval in dashboard (also some of its limitations) https://docs.splunk.com/Documentation/Splunk/latest/Viz/tokens#Define_token_filtering_and_formatting
<eval token="house_upper">upper("$house$")</eval>
@rsokolova try the following. Refer to Splunk documentation for using eval in dashboard (also some of its limitations) https://docs.splunk.com/Documentation/Splunk/latest/Viz/tokens#Define_token_filtering_and_formatting
<eval token="house_upper">upper("$house$")</eval>
FWIW,
I had to remove the quotes from the second part, otherwise I was setting the value of the new token to the name of the other token, not the value.
<eval token="tok_rig_lower">lower($tok_rig$)</eval>