hi @bhavneeshvohra,
Use replace function with eval command OR rex command with sed.
| eval abc=replace(abc, "\\\\", "")
OR
| rex field=abc mode=sed "s/\\\//g"
Then if you want to make field abc a multivalued field using makemv:
| eval abc=replace(abc, "\\\\", "") | makemv delim="," abc
Field abc is further expanded using mvexpand,
| eval abc=replace(abc, "\\\\", "") | makemv delim="," abc | mvexpand abc
If this reply helps you, an upvote/like would be appreciated.
