Solved: Re: How to replace every backslash in an input for...

cafissimo · ‎09-21-2017

Hello,
please I would like to know how I can replace a single "\" backslash with a double "\" backslash in a form input (simple xml) before submitting it.

I have tried with this code, but it does not work with splunk 6.5.x

    <input type="text" token="progetto">
      <label>Progetto (raddoppiare i "\")</label>
      <default>*</default>
      <initialValue>*</initialValue>
      <change>
         <eval token="progetto">replace('progetto',"\\\","\\\\\\")</eval>     
      </change>
    </input>

Thanks in advance.

cafissimo · ‎09-21-2017

I have found out a way to get what I want: it's done with custom JS code.

This is the form:

<form script="token_modify_mae.js">
   <label>test1</label>
   <fieldset>
     <input type="text" token="mytoken">
       <label>field1</label>
     </input>
   </fieldset>
   <row>
     <html>
       <p>Value1: $mytoken$</p>
       <p>Value2: $mymodtoken$</p>
     </html>
   </row>
 </form>

and this is the JS code:

require([
    "splunkjs/mvc",
    "splunkjs/mvc/simplexml/ready!"
], function(mvc) {
var defaultTokenModel = mvc.Components.get("default");
defaultTokenModel.on("change:mytoken", function(formQuery, mytoken) {
            alert("change it!");
            var tokenValue = defaultTokenModel.get("mytoken");
            newtoken = tokenValue.replace(/\\/g, "\\\\");
            defaultTokenModel.set('mymodtoken', newtoken);
        });
});

View solution in original post

cafissimo · ‎09-21-2017

I have found out a way to get what I want: it's done with custom JS code.

This is the form:

<form script="token_modify_mae.js">
   <label>test1</label>
   <fieldset>
     <input type="text" token="mytoken">
       <label>field1</label>
     </input>
   </fieldset>
   <row>
     <html>
       <p>Value1: $mytoken$</p>
       <p>Value2: $mymodtoken$</p>
     </html>
   </row>
 </form>

and this is the JS code:

require([
    "splunkjs/mvc",
    "splunkjs/mvc/simplexml/ready!"
], function(mvc) {
var defaultTokenModel = mvc.Components.get("default");
defaultTokenModel.on("change:mytoken", function(formQuery, mytoken) {
            alert("change it!");
            var tokenValue = defaultTokenModel.get("mytoken");
            newtoken = tokenValue.replace(/\\/g, "\\\\");
            defaultTokenModel.set('mymodtoken', newtoken);
        });
});

cafissimo · ‎09-21-2017

@DMohn: please, could you please provide me the complete form you used? Mine hangs on "waiting for input", even if I put test2 in my search query.
Thanks.

DMohn · ‎09-21-2017

<form>
  <label>test1</label>
  <fieldset>
    <input type="text" token="test1">
      <label>field1</label>
      <change>
        <eval token="test2">replace('test1',"\\\\","\\\\")</eval>
      </change>
    </input>
  </fieldset>
  <row>
    <html>
      <p>Value1: $test1$</p>
      <p>Value2: $test2$</p>
    </html>
  </row>
</form>

bekirk · ‎10-25-2019

<form>
  <label>test1</label>
  <fieldset>
    <input type="text" token="test1" searchWhenChanged="true">
      <label>field1</label>
      <change>
        <eval token="test2">replace($form.test1$,"\\\\","\\\\")</eval>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <html>
       <p>Value1: $test1$</p>
       <p>Value2: $test2$</p>
     </html>
    </panel>
  </row>
</form>

Changing 'test1' -> $form.test1$ seems to fix the issue cafissimo was having. I also think the searchWhenChanged might also be key to making this all work.

cafissimo · ‎09-21-2017

I am sorry, but it works in a weird way.
At first run of the form, if I put "\" in field1 nothing happens and field2 is shown as "$field2$".
If I add another "\" in field1 ("\") and submit again, the field2 value appears as "\\".
By the way, what I need is to repeat each "\" character.
For example:
\NAS\disc1\disc2 should become "\\NAS\disc1\disc2"
Maybe I should use javascript?

I am running splunk 6.5.3

DMohn · ‎09-21-2017

Hi @cafissimo

As paradox as it may seem - try the following code:

<fieldset>
  <input type="text" token="test1">
    <label>field1</label>
    <change>
      <eval token="test2">replace('test1',"\\\\","\\\\")</eval>
    </change>
  </input>
</fieldset>

This renders the correct results for me.

cafissimo · ‎09-21-2017

Progetto="$progetto$|s", with an initial value of "" for progetto field gives no results.
Also tried with value "\NAS" and still get no results.
(Obviously there are a lot of records in the index that have "\NAS" at the beginning of the field).

cmerriman · ‎09-21-2017

have you tried using field=$progetto|s$ in your search instead of trying to escape the backslash in your input? the |s will enclose the token in quotes and that might work.

also, i did test your input on 6.6.1, and it seems to work there if you plan on upgrading anytime soon.

How to replace every backslash in an input form token with a double backslash

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

They're back! Join the SplunkTrust and MVP at .conf24

Enterprise Security Content Update (ESCU) | New Releases