Please help me with the below query
I am using below query to extract array of json data
search storeAction="storeOffline" | eval OfflineStoreID = spath(_raw,"stores{}")
I am able to evaluate the list, like
TestT001 |
TestT002 |
Test0000 |
Test1000 |
Test2000 |
Test3000 |
I want the list which should have only ID's and I should remove Test. which should be as below
T001 |
T002 |
0000 |
1000 |
2000 |
3000 |
Please let me know how to do this.
You can use rex on a multivalue field like this
| makeresults
| eval Stores="TestT001,TestT002,Test0000,Test1000,Test2000,Test3000"
| eval Stores=split(Stores,",")
| rex field=Stores mode=sed "s/Test//g"
Hope this helps
Thank you 🙂 It is working and solved my issue.