Remove \ at the end of field values

[marco_massari11]

Hi,

I have some syslog logs and for a field those possible values:

myfield=sjhfshgfjwes\

myfield=abah\

myfield=dshaese\

I have a query tho show the result in a column chart:

index=myindex site=* myfield=*

| chart count by site myfield

When I click on a bar, I have another dashboard that shows some informations for the specific myfield, but I have an error  "Unbalanced quotes", I think for the final \. How can I remove \ at the end of the field values?

Thank you in advance

[richgalloway · Accepted solution]

Try this.

... | eval myfield=rtrim(myfield,"\\")