Trimming the value of a savedsearch parameter within the savedsearch

[jeffmartin]

I have a saved "MySearch" that takes a parameter "INPUT_SessionId", something like this:

index=foo
| ... some stuff
| search $INPUT_SessionId$
| ... more stuff

And then "MySearch" invoked like this

| savedsearch "MySearch" INPUT_SessionId="abc123"

My challenge is that sometimes me & my users accidentally invoke with curly braces around the SessionId (it's a long story), like this:

| savedsearch "MySearch" INPUT_SessionId="{abc123}"

When invoked this way, the search produces no results, which is confusing for user until they realize they accidentally included curly braces.

I'd like to change things inside of "MySearch" so that it strips curly braces from $INPUT_SessionId$ before continuing to use the value.

For a typical field value I know how to use trim like

| eval someField=trim(someField, "{}")

How do I do something like trim() but on the value of the parameter $INPUT_SessionId$ ?

[yuanliu · Accepted solution]

Let me clarify the requirement.  You want to modify the saved search so it can handle curly brackets that users may accidentally enter when invoking it.  If this correct, you can do something like

index=foo
| ... some stuff
| search
  [makeresults format=csv data="search
$INPUT_SessionId$"
  | eval search = replace(search, "{|}", "")
  | format]
| ... more stuff

(Note trim(someField, "{}") will not work in your use case because "{" does not appear in the beginning of $INPUT_SessionId$.)