Hi all,
i want to hide / delete / exclude some keyword like " supersaiyan" , "leave" from the below event using mvfilter. can anyone please tell me how to do it ?
| makeresults
| eval target_text="My name is supersaiyan, leave this to me"
Thanks
Hi
when you have normal field (not multivalue) then you can do it like
| makeresults
| fields - _time
| eval target_text="My name is supersaiyan, leave this to me"
| rex mode=sed field=target_text "s/(supersaiyan|leave)//g"
r. Ismo
thanks for your quick response @isoutamo .
This is for testing purpose, but i do have multi field values. could you please guide me how do this same thing using mvfilter.
Thanks
any thoughts ? @isoutamo