- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have a saved "MySearch" that takes a parameter "INPUT_SessionId", something like this:
index=foo
| ... some stuff
| search $INPUT_SessionId$
| ... more stuff
And then "MySearch" invoked like this
| savedsearch "MySearch" INPUT_SessionId="abc123"
My challenge is that sometimes me & my users accidentally invoke with curly braces around the SessionId (it's a long story), like this:
| savedsearch "MySearch" INPUT_SessionId="{abc123}"
When invoked this way, the search produces no results, which is confusing for user until they realize they accidentally included curly braces.
I'd like to change things inside of "MySearch" so that it strips curly braces from $INPUT_SessionId$ before continuing to use the value.
For a typical field value I know how to use trim like
| eval someField=trim(someField, "{}")
How do I do something like trim() but on the value of the parameter $INPUT_SessionId$ ?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Let me clarify the requirement. You want to modify the saved search so it can handle curly brackets that users may accidentally enter when invoking it. If this correct, you can do something like
index=foo
| ... some stuff
| search
[makeresults format=csv data="search
$INPUT_SessionId$"
| eval search = replace(search, "{|}", "")
| format]
| ... more stuff
(Note trim(someField, "{}") will not work in your use case because "{" does not appear in the beginning of $INPUT_SessionId$.)
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Let me clarify the requirement. You want to modify the saved search so it can handle curly brackets that users may accidentally enter when invoking it. If this correct, you can do something like
index=foo
| ... some stuff
| search
[makeresults format=csv data="search
$INPUT_SessionId$"
| eval search = replace(search, "{|}", "")
| format]
| ... more stuff
(Note trim(someField, "{}") will not work in your use case because "{" does not appear in the beginning of $INPUT_SessionId$.)
