How to replace string in text input before search?

[_smp_]

I have a simple form where a user inputs a MAC address in the format AA:BB:CC:DD:EE:FF. But the field that I'm going to search contains MAC addresses in a different format: AA-BB-CC-DD-EE-FF. So what I need to do is replace semicolons with hyphens in the value of the token before I perform the search. The eval statement is simple enough:
| eval mac_address=replace("AA:BB:CC:DD:EE:FF",":","-")
But it's not clear to me if I can do this eval with form input, or if I need to construct my query to do the replacement before I run the search. But I couldn't make it work either way.

[woodcock]

Assuming that your input sets a token called mac_address_token1, try this:

<input type="text" token="mac_address_token1">
...
    <change>
        <eval token="mac_address_token2">replace($mac_address_token1$,":","-")</eval>     
    </change>
</intput>

Then use $mac_address_token2$ inside of your search

[somesoni2 · Accepted solution]

You can have your text input to calculate the new token with formatted value and use the new token in your searches. Like this

....
 <input type="text" token="mac_tok">
      <label>Specify a log level</label>
      <default>INFO</default>
      <change>
         <eval token="mac_formatted">replace("$value$",":","-")</eval>
      </change>
    </input>
....

[mr_aksal]

hi, pretty old topic, but that was also what I was lookin for. 

However I had to remove  quotes from this part to make it work

replace("$value$",

thanks!!

[woodcock]

I am too slow again...

[exocore123]

Say I want to take in an input as index=index source=source filter=$inputfield$, and the input field just has a bunch of labels, but I want to map/replace the labels before the search actually happens, will this work in this case?

[_smp_]

Yes, that was the trick! I will need to study the <change> event handler doc. Thanks so much!