topic Can you rename strings within mv-fields in Getting Data In

Can you rename strings within mv-fields

lmacneil76 — Thu, 05 Jun 2014 19:09:55 GMT

Id like to rename every instance of "dragDrop" to "stackDragDrop" from a multi-value field.

The search below just renames one instance. Any ideas on how to do this?

source="C:\\var\\regression_items\\*.xml" 
| rex "title=\"(?P<id>\d+)\"" 
| rex max_match=0 "(class=\"stack\").+(data-type=\")(?P<STACK>\w+)(\")"
| eval TEST=mvfilter(STACK = "dragDrop")
| eval selectionElements=case(TEST="dragDrop", "stackDragDrop") 
| table id selectionElements TEST

Re: Can you rename strings within mv-fields

somesoni2 — Thu, 05 Jun 2014 19:24:58 GMT

Try this

source="C:\\var\\regression_items\\*.xml" 
| rex "title=\"(?P<id>\d+)\"" 
| rex max_match=0 "(class=\"stack\").+(data-type=\")(?P<STACK>\w+)(\")"
| eval TEST=mvfilter(STACK="dragDrop") |eval selectionElements=TEST | replace dragDrop with stackDragDrop in selectionElements
| table id selectionElements TEST

Re: Can you rename strings within mv-fields

lmacneil76 — Fri, 06 Jun 2014 01:51:02 GMT

Perfect! I was missing replace. Thanks!