The Account_Name and other fields show a dash (-) as a value in addition to the actual Account_Name. I can't filter it out since it does exclude the actual value. How can the field value be rectified to show only the proper value?
##### Explanation for SEDCMD Extractions #####
## windows_security_event_formater: This will replace all values like "Account Name:-" to "Account Name:"
##### SEDCMD Extractions #####
#SEDCMD-windows_security_event_formater = s/(?m)(^\s+[^:]+\:)\s+-?$/\1/g
Add to props.conf, remove the # before SEDCMD-windows_security_event_formater.
mvfilter?
| eval Account_Name=mvfilter(!match(Account_Name,"^-$"))
Try this -
| eval Account_Name = mvindex(Account_Name,1)
Thank you for the suggestion but I need to find the way to fix the filed at indexing so it won't be split in two values and the dash excluded. Excluding/masking it during search will require for me to be always available when a user wants to do a search