How can I format output with boolean for one or more results

[tkwaller1]

Hello

I am working on creating a search that eval's results and adds boolean strings. the results will then be passed as a token to later searches. The result of the search could be a single ID or multiple IDs.

The idea is that the first panel lists IDs. The next panel in the dashboard will search an index but only for IDs from the first panel. 

For example:

Panel 1

index=db source=MSGTBL  MSG_src="XXXX" MSG_DOMAIN="CCCCCCCC" "<messageType>AAA</messageType>"
| eval MSGID1="MSGID="+MSGID+" OR"
| table MSGID

might give you a table of MSGIDs:
MSGID=56454GF-5RT1KL-566IOS-FT5GFAS OR
MSGID=56454GF-65WE-566IOS-5845UIK OR
MSGID=SD8734-DFH745-DFHJ7867-GKJH8 OR

I can then set that as a token like

<done>
  <set token="tokMSGID1">$result.MSGID1$</set>
</done>

The issue im having is that if there is only a single MSGID it will have an 'OR' at the end as well as the last result in a set of IDs would have the 'OR' at the end.

Can anyone tell me search-wise how to handle this?

Thanks!

[richgalloway]

Check out the format command.  It will put the available fields into a sequence of OR clauses.

index=db source=MSGTBL  MSG_src="XXXX" MSG_DOMAIN="CCCCCCCC" "<messageType>AAA</messageType>"
| fields MSGID
| format

[tkwaller1]

I like it.
I added some sed commands to pull out the parenthesis as it was causing issues searching once the values were passed via token. but once I did that the rest of the panels worked.

Thanks!