After using an SED command in props.conf, how come our query with the replace command is no longer working?

[cyber_castle]

Hello,

I have one of the field in Cyberark which has a special character.

Retrieve [File
Monitor [FW] end
Monitor [FW] start
Monitor [DR] end
Monitor DR] start
Open File
Set Password
Logon
Logoff
Monitor Backup] end

SED Command in props.conf --> SEDCMD-cef_name = s/[][]/ /g

I have used SED command in props to replace the special characters, but the client is not happy because we are altering the real data and its syntax. Then, I have reverted the change and tried using the replace command, but for some reason, my replace command is not working.

replace(cef_name, "[ ]", "")

[whrg · Accepted solution]

Hello @cyber_castle,

If I understand correctly, you want to remove special characters while running a search.

Note that there is a replace command as well as a replace eval function.

I think you are better off here with the eval function:

| eval cef_name=replace(cef_name,"[\[\]]"," ")

[cyber_castle]

Thanks for your answer. It worked.