How do I remove a dash (-) from the Account_Name field?

[AbelCruz]

The Account_Name and other fields show a dash (-) as a value in addition to the actual Account_Name. I can't filter it out since it does exclude the actual value. How can the field value be rectified to show only the proper value?

[spayneort]

##### Explanation for SEDCMD Extractions #####
## windows_security_event_formater: This will replace all values like "Account Name:-" to "Account Name:"

##### SEDCMD Extractions #####
#SEDCMD-windows_security_event_formater = s/(?m)(^\s+[^:]+\:)\s+-?$/\1/g   

Source

Add to props.conf, remove the # before SEDCMD-windows_security_event_formater.

[twinspop]

mvfilter?

| eval Account_Name=mvfilter(!match(Account_Name,"^-$"))

[saurabhkharkar]

Try this -

| eval Account_Name = mvindex(Account_Name,1)

[AbelCruz]

Thank you for the suggestion but I need to find the way to fix the filed at indexing so it won't be split in two values and the dash excluded. Excluding/masking it during search will require for me to be always available when a user wants to do a search