Hi,
I have some syslog logs and for a field those possible values:
myfield=sjhfshgfjwes\
myfield=abah\
myfield=dshaese\
I have a query tho show the result in a column chart:
index=myindex site=* myfield=*
| chart count by site myfield
When I click on a bar, I have another dashboard that shows some informations for the specific myfield, but I have an error "Unbalanced quotes", I think for the final \. How can I remove \ at the end of the field values?
Thank you in advance
Try this.
... | eval myfield=rtrim(myfield,"\\")
Try this.
... | eval myfield=rtrim(myfield,"\\")