I'm trying to replicate other threads that show how to replace line breaks with delimiters. This search is not working.
| ldapsearch domain=ED search="(&(objectClass=eduPerson)(weillCornellEduCWID=paa2013))" attrs="weillCornellEduCWID,o"
| eval o1 = replace (o, "[\\n\\r]+","|")
| eval o2 = replace (o, "[\n\r]","|")
| table weillCornellEduCWID, o, o1, o2
Any ideas? See screenshot below..
try something like this,
your base search.... | eval o1=o |nomv o1 | rex mode=sed field=o1 "s/\n/|/g"
try something like this,
your base search.... | eval o1=o |nomv o1 | rex mode=sed field=o1 "s/\n/|/g"
does exactly what I needed, and much simpler
than the replace function I was trying to get to work.
It works like a charm. Thanks!
Does this work?
| ldapsearch domain=ED search="(&(objectClass=eduPerson)(weillCornellEduCWID=paa2013))" attrs="weillCornellEduCWID,o"
| eval o1 = replace (o, "[\r\n]+","|")
| eval o2 = replace (o, "\n","|")
| table weillCornellEduCWID, o, o1, o2
Thanks for your response, somesoni2. Unfortunately, no. When I run the query, I just get blanks in the o1 and o2 fields.
So, if I'm not wrong, the field o is a multivalued field and you just want to make it linear with delimiter as pipe. Is that correct?
If that is correct, what do you get when you run this?
| ldapsearch domain=ED search="(&(objectClass=eduPerson)(weillCornellEduCWID=paa2013))" attrs="weillCornellEduCWID,o"
| eval o1 =o | nomv o1
Also, give this a try
| ldapsearch domain=ED search="(&(objectClass=eduPerson)(weillCornellEduCWID=paa2013))" attrs="weillCornellEduCWID,o"
| eventstats values(o) as o1 delim="|" | nomv o1