Hello Everyone!
I want to remove the first two letters from my fields "\n" how can I do it?
\nCDIARIA2
\nCDIARIAC
\nMAROV91
\nMAFTB87
\nMATBU90
I only want this:
CDIARIA2
CDIARIAC
MAROV91
MAFTB87
MATBU90
Regards!
You can use a regex to exclude the first 2 characters. If all of them have \n you could simple use \n(?.+?) with the |rex command.
Okay too slow in the morning hours 😉
here is my answer anyway:
| makeresults
| eval foo="\nCDIARIA2 \nCDIARIAC \nMAROV91 \nMAFTB87 \nMATBU90"
| makemv foo
| mvexpand foo
| eval jobname=ltrim(foo,"\n")
| stats count by jobname
The first 4 lines are just to produce dummy data, the ltrim()
is the one you can use to remove unwanted characters from the left.
cheers, MuS
This is neater than mine. +1
@somesoni2, it is neat, but performance wise yours is better because you are performing the replace after the stats (hence working on less events rather than all). On similar lines, following would be a faster search.
<BaseSearch>
| stats count by jobname
| eval jobname=ltrim(foo,"\n")
Here we go: three Fezzes make up a perfect answer 😉
Thanks so much!
Best Regards!
Try like this (run anywhere sample search, just add the last eval line to your existing search)
| gentimes start=-1 | eval jobname="\nCDIARIA2 \nCDIARIAC \nMAROV91 \nMAFTB87 \nMATBU90" | makemv jobname | mvexpand jobname | stats count by jobname
| eval jobname=replace(jobname,"\\\n","")
My answer would be same as somesoni
eval jobname=replace(jobname,"\\\n","")
Thanks so much!
It works!
Best Regards!
You can use a regex to exclude the first 2 characters. If all of them have \n you could simple use \n(?.+?) with the |rex command.
Can you provide more details around how you get these fields, please?
Hello MuS! Thanks for your answer.
This is the query I'm using
index=mf JCL ERROR* |stats count by jobname
An it brings me this but I don't want the \n
\nCDIARIA2
\nCDIARIAC
\nMAROV91
\nMAFTB87
\nMATBU90