In my IIS logs, i have the client name 'Company=A&B+Example'. When i query this in my dashboard, I see the Company name as just A.

[prateedshetty]

Also if the company name were 'Company=Apple+Banana', how can I ignore the + to make the Company name look like Apple Banana once added in the dashboard.

Final Result should be:
Company
A&B Example
Apple Banana

How I see it now
Company
A
Apple+Banana

[prateedshetty]

This worked

sourcetype=abc| rex field=Company mode=sed "y/+/ /" |stats count by Company

[DalJeanis · Accepted solution]

First, to get the data pulled into the company name at all, you'll probably have to get into the regex that is parsing the company name, and add "+" and "&" as valid characters. That may be a problem, because "&" especially may be used for other things in your _raw data, so there'll be a bit of testing involved.

Second, you may want to use rex to convert the "&" and "+" characters either into spaces or into nothing. The choice depends on how many of these you have in your data, and what variations need to be addressed.

If you want more specific advice, then you'll need to post the stanza that is extracting the Company from the data, and a few examples of _raw so we can be sure we have all necessary patterns covered.

[prateedshetty]

I just tried the below query to replace + with space.

sourcetype=abc "https://www.abc.com" | rex field=Company mode=sed "s/+/ /g" | Top Company

and I get --> Error in 'rex' command: Regex: quantifier does not follow a repeatable item

[prateedshetty]

This just worked though..

............| rex field=Company mode=sed "y/+/ /" |.......

[DalJeanis]

Good. glad you got it handled.

If that's all you needed, then please accept the answer so the question will show as closed.