I'm trying to implement a custom token filter based on the [Transform and validate tokens](http://dev.splunk.com/view/webframework-concepts/SP-CAAAEW4) docs, but can't quite seem to make it work.
Targeting Splunk 6.3-6.5. Testing on 6.5.0.
**Broken Example**
Javascript `$SPLUNK_HOME/etc/apps/search/appserver/static/lowell_filter.js`:
require([
"splunkjs/mvc",
], function(mvc) {
mvc.setFilter("testFilter", function(inputValue) {
return "It worked " + inputValue;
});
}
Example Dashboard:
|
|
When I click on a row, the s and s+u filters show what I would expected, but the last line shows the literal value, still surrounded in dollar marks.
Filter testFilter: $message|testFilter$
**Update:**
I've determined that if I run the following code interactively from my browser's Javascript console, that the filter is called as expected.
window.splunkjs.mvc.setFilter("testFilter", function(inputValue) {
return "It worked " + inputValue;
});
If I click on the table, triggering the drilldown action, then it adds the "It worked" prefix onto the token value. I think this validates that I'm calling the right function, and the desired functionality is present, just that I have something wrong in how/where I'm calling `setFilter()`.
↧