I have a simple form where a user inputs a MAC address in the format AA:BB:CC:DD:EE:FF. But the field that I'm going to search contains MAC addresses in a different format: AA-BB-CC-DD-EE-FF. So what I need to do is replace semicolons with hyphens in the value of the token before I perform the search. The eval statement is simple enough:| eval mac_address=replace("AA:BB:CC:DD:EE:FF",":","-")
But it's not clear to me if I can do this eval with form input, or if I need to construct my query to do the replacement before I run the search. But I couldn't make it work either way.
You can have your text input to calculate the new token with formatted value and use the new token in your searches. Like this
....
<input type="text" token="mac_tok">
<label>Specify a log level</label>
<default>INFO</default>
<change>
<eval token="mac_formatted">replace("$value$",":","-")</eval>
</change>
</input>
....
Assuming that your input sets a token called mac_address_token1
, try this:
<input type="text" token="mac_address_token1">
...
<change>
<eval token="mac_address_token2">replace($mac_address_token1$,":","-")</eval>
</change>
</intput>
Then use $mac_address_token2$
inside of your search
You can have your text input to calculate the new token with formatted value and use the new token in your searches. Like this
....
<input type="text" token="mac_tok">
<label>Specify a log level</label>
<default>INFO</default>
<change>
<eval token="mac_formatted">replace("$value$",":","-")</eval>
</change>
</input>
....
hi, pretty old topic, but that was also what I was lookin for.
However I had to remove quotes from this part to make it work
replace("$value$",
thanks!!
I am too slow again...
Say I want to take in an input as index=index source=source filter=$inputfield$
, and the input field just has a bunch of labels, but I want to map/replace the labels before the search actually happens, will this work in this case?
Yes, that was the trick! I will need to study the <change>
event handler doc. Thanks so much!