how to remove start and last character from field value please find the example below
Example
test=road-car
test=a_road_car-ts
test=road-bus
test=a_road_bus-ts
if i execute stats value result must be road-car=2 and road-bus=2
Like this (the secret sauce is in the sed
command; you may need to adjust the 2
to something different.):
| makeresults|eval test="road-car a_road_car-ts road-bus a_road_bus-ts"
| makemv test
| mvexpand test
| rex field=test mode=sed "s/_/-/g s/^[^-]{1,2}[-]// s/[-][^-]{1,2}$//"
| stats count BY test
Can You try this:
| makeresults
| eval test="road-car,a_road_car-ts,road-bus,a_road_bus-ts"
| makemv delim="," test
| mvexpand test
| rex field=test "(?<test>road[-_][^-]*)"
| replace *_* with *-* IN test
In your request:
<Your_searcg> | rex field=test "(?<test>road[-_][^-]*)" | replace *_* with *-* IN test
The title of your post implies removal of a single character from each end of the field, however, your examples remove multiple characters. There's also a mix of hyphens and underscores. Using your examples as a template, this rex
command should do the job for you.
... | rex field=test "(?:\w_)?(?<foo>[-\w]+)(?:-\w\w)?" | stats count by foo | ...
Can you try the following:
<yourSearch>
| stats count(eval(match(test,"car"))) as road-car count(eval(match(test,"bus"))) as road-bus
Following is a run anywhere search based on sample data provided.
| makeresults
| eval data="test=road-car;test=a_road_car-ts;test=road-bus;test=a_road_bus-ts"
| makemv data delim=";"
| mvexpand data
| rename data as _raw
| KV
| stats count(eval(match(test,"car"))) as road-car count(eval(match(test,"bus"))) as road-bus