My field name is 'fileName' and the values it contains are like this:
PVOLFEPCL-00515+Berger+Profile+Settings.docx
Intake3++B2N+Lan+07492018.xlsm
I want it to be like this,
PVOLFEPCL-00515 Berger Profile Settings.docx
Intake3 B2N Lan 07492018.xlsm
The ''+" has to be replaced by Space .
I tried the following , but it doesn't work:
host="*evilcorp*.fantasy.com" "affirative"
| rex field=_raw "^[^&\n]*&\w+=(?P<fileName>[^ ]+)(?:[^ \n]* ){3}(?P<ttr>.+)"
| table userid fileName ttr
| replace "+" WITH "" IN fileName
Hi @zacksoft,
Please try below query.
<yourBaseQuery>
| rex mode=sed field=<fieldname> "s/([^\+])(?:\++)/\1 /g"
Here is run anywhere search which is generating correct ouput
| makeresults | eval testfield="PVOLFEPCL-00515+Berger+Profile+Settings.docx"
| append [ makeresults | eval testfield="Intake3++B2N+Lan+07492018.xlsm" ]
| rex mode=sed field=testfield "s/([^\+])(?:\++)/\1 /g"
Hi @zacksoft,
Please try below query.
<yourBaseQuery>
| rex mode=sed field=<fieldname> "s/([^\+])(?:\++)/\1 /g"
Here is run anywhere search which is generating correct ouput
| makeresults | eval testfield="PVOLFEPCL-00515+Berger+Profile+Settings.docx"
| append [ makeresults | eval testfield="Intake3++B2N+Lan+07492018.xlsm" ]
| rex mode=sed field=testfield "s/([^\+])(?:\++)/\1 /g"
hi @zacksoft
try this |makeresults |eval hari="Intake3++B2N+Lan+07492018.xlsm" |table hari | rex field=hari mode=sed "s/\+/ /g"
if it is helped accept as answer