Double value in field

[keyu921]

I am searching windows event log.

Aftre result search complete, Account_Domain contains following value

"-
ABC"

How can I left ABC inside??

| rex field="Account_Domain" mode=sed "s/([0-9]{4}) /\1,,/" not working

[vnravikumar · Accepted solution]

Hi

Check this

| rex field=Account_Domain max_match=0 "(?P<Account_Domain>\w+)"

[keyu921]

Become like this

Account_Domain

ALPHA

ALPHA

[vnravikumar]

Can you provide some sample data with the expected output?