Splunk Search

Help) spl query

tkdguq0110
Path Finder

Hey guys. I'm a beginner of Splunk 
I have a one question. 
I  get a input value

but value has a space. so I want to remove it

here's my code

 

<input type="text"  token="field55">      // field55 is 'temp token'

<lable>test </lable>

<change>

<eval token="field5"> trim($value$)</eval> // field5 is 'real token'

</change>

</input>

.....

<query>

index=mail    mail_sender= "$field5$"
|  table mail_sender 

</query>

 

if I input like 'test123  '  the result value is 'test123' (no spaces) 
how can I do that?? 
So sorry hard to read
please help me out!!

Labels (1)
0 Karma
1 Solution

renjith_nair
Legend

Isn't it possible to trim it in the search?

<form>
  <label>Text Space</label>
  <fieldset submitButton="false">
    <input type="text" token="input">
      <label>Input</label>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>|makeresults|eval acutal_text="$input$"|eval actal_length=len("$input$")|eval trimmed_text=trim(acutal_text)|eval trimmed_length=len(trimmed_text)</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</form>
---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

Pbarboza
New Member

I have some files uploaded onto my splunk, but when I used spl like this (index=web sourcetype=access* status=200 product_name=* | table JSESSIONID,price,product_name), for example, I do not get any results.

What am I doing wrong? 

My email is barbozaprince@gmail.com

0 Karma

tkdguq0110
Path Finder

Thank you for you answer 

If I input index  field,  Is it possible to use both Index and makeresults ?

 
0 Karma

renjith_nair
Legend

@tkdguq0110 , that's just a run anywhere example with dummy data. So you can replace makeresults with your original search

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

renjith_nair
Legend

Isn't it possible to trim it in the search?

<form>
  <label>Text Space</label>
  <fieldset submitButton="false">
    <input type="text" token="input">
      <label>Input</label>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>|makeresults|eval acutal_text="$input$"|eval actal_length=len("$input$")|eval trimmed_text=trim(acutal_text)|eval trimmed_length=len(trimmed_text)</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</form>
---
What goes around comes around. If it helps, hit it with Karma 🙂
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...