Hey All,
wondering if I can get some input on this. I have data coming in as JSON. The fields follow this naming convention:
objects.Server::34385.fields.friendlyname = Server123
objects.Server::88634.fields.friendlyname = Server444
What I'm trying to do is to somehow rename the fields, so I omit the ::<number> after the Server part.
End result is needed to be like this:
objects.Server.fields.friendlyname = Server123
objects.Server.fields.friendlyname = Server444
It's worth mentioning that there are around 10k servers, so I can't list them out one by one.
Try something like this
| foreach *::*.*
[| eval "<<MATCHSEG1>>.<<MATCHSEG3>>" = if(isnotnull('<<FIELD>>'),'<<FIELD>>','<<MATCHSEG1>>.<<MATCHSEG3>>')]
Try something like this
| foreach *::*.*
[| eval "<<MATCHSEG1>>.<<MATCHSEG3>>" = if(isnotnull('<<FIELD>>'),'<<FIELD>>','<<MATCHSEG1>>.<<MATCHSEG3>>')]
@ITWhisperer Thanks so much, was able to get what I needed with the | foreach
Marking as solution and DM