How can I skip the first two "\n" letters from my fields?

[danielgp89]

Hello Everyone!

I want to remove the first two letters from my fields "\n" how can I do it?

\nCDIARIA2
\nCDIARIAC
\nMAROV91
\nMAFTB87
\nMATBU90

I only want this:

CDIARIA2
CDIARIAC
MAROV91
MAFTB87
MATBU90

Regards!

[MuS]

Okay too slow in the morning hours 😉

here is my answer anyway:

| makeresults
| eval foo="\nCDIARIA2 \nCDIARIAC \nMAROV91 \nMAFTB87 \nMATBU90" 
| makemv foo 
| mvexpand foo
| eval jobname=ltrim(foo,"\n") 
| stats count by jobname

The first 4 lines are just to produce dummy data, the ltrim() is the one you can use to remove unwanted characters from the left.

cheers, MuS

[somesoni2]

This is neater than mine. +1

[niketn]

@somesoni2, it is neat, but performance wise yours is better because you are performing the replace after the stats (hence working on less events rather than all). On similar lines, following would be a faster search.

<BaseSearch>
 | stats count by jobname
 | eval jobname=ltrim(foo,"\n") 

[MuS]

Here we go: three Fezzes make up a perfect answer 😉

[danielgp89]

Thanks so much!

Best Regards!

[somesoni2]

Try like this (run anywhere sample search, just add the last eval line to your existing search)

| gentimes start=-1 | eval jobname="\nCDIARIA2 \nCDIARIAC \nMAROV91 \nMAFTB87 \nMATBU90" | makemv jobname | mvexpand jobname | stats count by jobname 
| eval jobname=replace(jobname,"\\\n","")

[akocak]

My answer would be same as somesoni

    eval jobname=replace(jobname,"\\\n","")

[danielgp89]

Thanks so much!

It works!

Best Regards!

[oawelewa · Accepted solution]

You can use a regex to exclude the first 2 characters. If all of them have \n you could simple use \n(?.+?) with the |rex command.

[MuS]

Can you provide more details around how you get these fields, please?

[danielgp89]

Hello MuS! Thanks for your answer.

This is the query I'm using

index=mf JCL ERROR* |stats count by jobname

An it brings me this but I don't want the \n

jobname count

\nCDIARIA2
\nCDIARIAC
\nMAROV91
\nMAFTB87
\nMATBU90