Manipulate a Token String in a Form

[mjosen]

I would like to modify the token a user inputs in a form using rex commands so that I can insert it into the search later. For instance, if the user enters AC123,AC456 in the form field, I would want that to be plugged into the search as 'AC123','AC456'. Is there anyway to do this?

<input type="text" token="account" searchWhenChanged="false">
  <label>Account</label>
  <default>AC123,AC456</default>
</input>

[martin_mueller · Accepted solution]

This should be doable using an eval-based macro. For example, if you wanted to turn a token containing "error,warn" into "error OR warn" you can run this search:

index=_internal `commasToOr("error,warn")`

using this eval-based macro definition:

[commasToOr(1)]
args = token
definition = replace("$token$", ",", " OR ")
iseval = 1

Looking at the job inspector, the search that was actually executed is this:

search index=_internal error OR warn

You can apply the same strategy to adding single quotes using replace, and this should work from your form as well.

[somesoni2]

You can do the manipulation within the search itself where you'll be using it. E.g. (assuming you use search filter using token like account=$account$

index=abc sourcetype=xyz [search index=abc | head 1 | eval account="'$account$'" | table account | eval account=replace(account,",","','")]...