topic Re: Replace string in text input before search in Dashboards & Visualizations

How to replace string in text input before search?

_smp_ — Mon, 03 Oct 2022 13:48:19 GMT

I have a simple form where a user inputs a MAC address in the format AA:BB:CC:DD:EE:FF. But the field that I'm going to search contains MAC addresses in a different format: AA-BB-CC-DD-EE-FF. So what I need to do is replace semicolons with hyphens in the value of the token before I perform the search. The eval statement is simple enough:
| eval mac_address=replace("AA:BB:CC:DD:EE:FF",":","-")
But it's not clear to me if I can do this eval with form input, or if I need to construct my query to do the replacement before I run the search. But I couldn't make it work either way.

Re: Replace string in text input before search

somesoni2 — Wed, 29 Mar 2017 17:51:38 GMT

You can have your text input to calculate the new token with formatted value and use the new token in your searches. Like this

....
 <input type="text" token="mac_tok">
      <label>Specify a log level</label>
      <default>INFO</default>
      <change>
         <eval token="mac_formatted">replace("$value$",":","-")</eval>
      </change>
    </input>
....

Re: Replace string in text input before search

_smp_ — Wed, 29 Mar 2017 18:21:10 GMT

Yes, that was the trick! I will need to study the <change> event handler doc. Thanks so much!

Re: Replace string in text input before search

woodcock — Wed, 29 Mar 2017 18:27:45 GMT

Assuming that your input sets a token called mac_address_token1, try this:

<input type="text" token="mac_address_token1">
...
    <change>
        <eval token="mac_address_token2">replace($mac_address_token1$,":","-")</eval>     
    </change>
</intput>

Then use $mac_address_token2$ inside of your search

Re: Replace string in text input before search

woodcock — Wed, 29 Mar 2017 18:28:33 GMT

I am too slow again...

Re: Replace string in text input before search

exocore123 — Fri, 09 Jun 2017 22:56:19 GMT

Say I want to take in an input as index=index source=source filter=$inputfield$, and the input field just has a bunch of labels, but I want to map/replace the labels before the search actually happens, will this work in this case?

Re: Replace string in text input before search

mr_aksal — Mon, 03 Oct 2022 08:58:11 GMT

hi, pretty old topic, but that was also what I was lookin for.

However I had to remove quotes from this part to make it work

replace("$value$",

thanks!!