Alerting

How do I remove a dash (-) from the Account_Name field?

AbelCruz
Path Finder

The Account_Name and other fields show a dash (-) as a value in addition to the actual Account_Name. I can't filter it out since it does exclude the actual value. How can the field value be rectified to show only the proper value?

alt text

Tags (1)
0 Karma

spayneort
Contributor
##### Explanation for SEDCMD Extractions #####
## windows_security_event_formater: This will replace all values like "Account Name:-" to "Account Name:"

##### SEDCMD Extractions #####
#SEDCMD-windows_security_event_formater = s/(?m)(^\s+[^:]+\:)\s+-?$/\1/g   

Source

Add to props.conf, remove the # before SEDCMD-windows_security_event_formater.

twinspop
Influencer

mvfilter?

| eval Account_Name=mvfilter(!match(Account_Name,"^-$"))
0 Karma

saurabhkharkar
Path Finder

Try this -

| eval Account_Name = mvindex(Account_Name,1)

0 Karma

AbelCruz
Path Finder

Thank you for the suggestion but I need to find the way to fix the filed at indexing so it won't be split in two values and the dash excluded. Excluding/masking it during search will require for me to be always available when a user wants to do a search

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>