I have a saved "MySearch" that takes a parameter "INPUT_SessionId", something like this: index=foo | ... some stuff | search $INPUT_SessionId$ | ... more stuff And then "MySearch" invoked like this | savedsearch "MySearch" INPUT_SessionId="abc123" My challenge is that sometimes me & my users accidentally invoke with curly braces around the SessionId (it's a long story), like this: | savedsearch "MySearch" INPUT_SessionId="{abc123}" When invoked this way, the search produces no results, which is confusing for user until they realize they accidentally included curly braces. I'd like to change things inside of "MySearch" so that it strips curly braces from $INPUT_SessionId$ before continuing to use the value. For a typical field value I know how to use trim like | eval someField=trim(someField, "{}") How do I do something like trim() but on the value of the parameter $INPUT_SessionId$ ?

here is the current data   Feb 27 14:12:38 node0: -------------------------------------------------------------------------- Attack database version:3670(Thu Feb 22 14:12:38 2024 UTC) Detector version :12.2.140230313 Policy template version :3535 node1: -------------------------------------------------------------------------- Attack database version:3670(Thu Feb 22 14:12:38 2024 UTC) Detector version :12.2.140230313 Policy template version :3535 {primary:node0}     i need help extracting the values for attack version (just the digit), detector version and policy template version, by node (ie: node 0 and node 1)   output looks like something like this   Node               Attack database version                 Detector version                Policy template version node0             3670                                                         12.2.140230313               3535 node1             3670                                                         12.2.140230313               3535     please and thank you, i am only able to get the node0 but not node1