How can I remove excess characters from my fields?

[AKG1_old1]

Hi,

In my log file one field called Script Name contains some unnecessary details, which I want to remove.

My requirement is to remove "qcst_" ".sh" and all others arguments like "-LS" "/hp267srv/apps/MXTEST" etc

Actual Data:

qcst_mxStEnvLoad.sh
qcst_ZipLastRun.sh Order_Simulation /hp267srv/apps/MXTEST /net/hp267srv/hp267srv/apps/MXTEST Order_Simulation
qcst_runningProcessesDetails.sh -LS

Expected:

mxStEnvLoad
ZipLastRun
runningProcessesDetails

Thanks
Ankit

[alemarzu]

Hi there @agoyal

Assuming that you already have a field that contains those values (ie, command) you can create a new field from it with the new values, like this.

base search | rex field="command" "^\S+_(?<trimmed_command>[^\.]+)\.\S+"

Hope it helps.

[sbbadri · Accepted solution]

try this

.... | rex field=_raw "qcst_(?P<field1>\S+).sh"