Replace a query string variable value

Hi John,

I know the nocase flag isn't supported with switch statements as Joe pointed out in this post (Click here). But -nocase should work for string map:

 
 when RULE_INIT { 
  
    log local0. "[string map {find replace} "search in string: FIND replace"]" 
    log local0. "[string map -nocase {find replace} "search in string: FIND replace"]" 
  
 } 
 

Log output:

Rule : search in string: FIND replace

Rule : search in string: replace replace

Maybe it was down to using a variable with curly braces? This would not work because the curly braces force a literal interpretation of the search/replace fields:

 
 ... 
    set find "abc" 
    set replace "xyz" 
  
    log local0. "[string map {$find $replace} "search in string: abc"]" 
 ... 
 

Log output:

Rule : search in string: abc

You could use quotes instead to allow for variable expansion:

 
    set find "abc" 
    set replace "xyz" 
  
    log local0. "[string map "$find $replace" "search in string: abc"]" 
 

Rule : search in string: xyz

Aaron