topic How do I remove a dash (-) from the Account_Name field? in Alerting

How do I remove a dash (-) from the Account_Name field?

AbelCruz — Tue, 29 Sep 2020 22:24:56 GMT

The Account_Name and other fields show a dash (-) as a value in addition to the actual Account_Name. I can't filter it out since it does exclude the actual value. How can the field value be rectified to show only the proper value?

Re: How do I remove a dash (-) from the Account_Name field?

saurabhkharkar — Tue, 29 Sep 2020 22:29:34 GMT

Try this -

| eval Account_Name = mvindex(Account_Name,1)

Re: How do I remove a dash (-) from the Account_Name field?

AbelCruz — Mon, 17 Dec 2018 17:22:23 GMT

Thank you for the suggestion but I need to find the way to fix the filed at indexing so it won't be split in two values and the dash excluded. Excluding/masking it during search will require for me to be always available when a user wants to do a search

Re: How do I remove a dash (-) from the Account_Name field?

twinspop — Mon, 17 Dec 2018 19:08:35 GMT

mvfilter?

| eval Account_Name=mvfilter(!match(Account_Name,"^-$"))

Re: How do I remove a dash (-) from the Account_Name field?

spayneort — Tue, 29 Sep 2020 22:25:17 GMT

##### Explanation for SEDCMD Extractions #####
## windows_security_event_formater: This will replace all values like "Account Name:-" to "Account Name:"

##### SEDCMD Extractions #####
#SEDCMD-windows_security_event_formater = s/(?m)(^\s+[^:]+\:)\s+-?$/\1/g

Source

Add to props.conf, remove the # before SEDCMD-windows_security_event_formater.