Can you help me create the regex to replace multiple characters in the following field?

[sistemistiposta]

Hello,

I extracted a field like this:

folder="prova^1.ED56GH"

and I want to change it at search time by replacing all dots with "/", and then all ^ with dot. In the example I will obtain:

folder="prova.1/ED56GH"

I write in props.conf:

EVAL-folder = if ( match(folder, "."), replace(folder, "([^\.]+)\.(.+)", "\1/\2"), folder)

to replace "." with "/". But I can't retype:

EVAL-folder = if ( match(folder, "^"), replace(folder, "([^\^]+)\^(.+)", "\1.\2"), folder)

to replace ^ with "." after first EVAL. It doesn't work.
So, how can I achieve this?

Many many thanks!

Marco

[whrg · Accepted solution]

Hi! Check this out:

| makeresults count=1
| eval folder="prova^1.ED56GH"
| rex mode=sed field=folder "s/\./\//g"
| rex mode=sed field=folder "s/\^/./g"

Then you get:

folder
prova.1/ED56GH

Alternatively:

| makeresults count=1
| eval folder="prova^1.ED56GH"
| eval folder=replace(replace(folder,"\.","/"),"\^",".")

You could save this eval expression as a calculated field via Settings / Fields / Calculated fields.

[sistemistiposta]

I was sure to forget some tricks 🙂
Thank you very much @whrg. What I'm looking for is the alternative:
folder=replace(replace(folder,"\.","/"),"\^",".")
which I can add in props.conf.

Thank you very much, have a great day!