Can I refer to a token dynamically in Splunk?

Question

New to Splunk...

Not sure if there is a way to do this.

Let's say I have a token

<set token="token_1">one</set>
<set token="token_2">two</set>

Let's say I have another token:

<set token="qualifer">1</set>

Can I then do something like

<eval token="value"> token_{qualifer} </eval>

and basically set value to one (the value of token_1)? Effectively...

<set token="value"> one </set>

Answer 1

Tokens in Splunk are referenced by enclosing the token name in $ .

<eval token="value">token_$qualifer$</eval>

should work.

But what you want is a nested token reference, which would look something like this:

<eval token="value">$token_$qualifer$$</eval>

I'm not sure it will work.