Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

How to use a custom token filter within Simple XML

$
0
0
I'm trying to implement a custom token filter based on the [Transform and validate tokens](http://dev.splunk.com/view/webframework-concepts/SP-CAAAEW4) docs, but can't quite seem to make it work. Targeting Splunk 6.3-6.5. Testing on 6.5.0. **Broken Example** Javascript `$SPLUNK_HOME/etc/apps/search/appserver/static/lowell_filter.js`: require([ "splunkjs/mvc", ], function(mvc) { mvc.setFilter("testFilter", function(inputValue) { return "It worked " + inputValue; }); } Example Dashboard: index=_internal sourcetype=splunkd | cluster showcount=true | table _time, log_level, component, message, cluster_count | sort - cluster_count-1h@m@m$row.message$

Message

Filter s: $message|s$ <br/> Filter s+u: $message|s|u$ <br/> Filter testFilter: $message|testFilter$ <br/>
When I click on a row, the s and s+u filters show what I would expected, but the last line shows the literal value, still surrounded in dollar marks. Filter testFilter: $message|testFilter$ **Update:** I've determined that if I run the following code interactively from my browser's Javascript console, that the filter is called as expected. window.splunkjs.mvc.setFilter("testFilter", function(inputValue) { return "It worked " + inputValue; }); If I click on the table, triggering the drilldown action, then it adds the "It worked" prefix onto the token value. I think this validates that I'm calling the right function, and the desired functionality is present, just that I have something wrong in how/where I'm calling `setFilter()`.

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>