The below table is what I get from a search on Splunk"
ActiveLoadId
Jabber_for_iOS-12.1.2.270036
Jabber_for_iOS-12.0.1.263155
Jabber_for_Android-12.5.1.276987
Jabber_for_Windows-11.9.3.60004
Jabber_for_Windows-12.5.0.22884
But what i want is to modify the output text under Field "ActiveLoadID" to see the first few characters. Example below:
ActiveLoadId
Jabber_for_iOS
Jabber_for_iOS
Jabber_for_Android
Jabber_for_Windows
Jabber_for_Windows
My current query is:
"ActiveLoadId=Jabber_for" | rare limit=20000 ActiveLoadId
Appreciate your help!
Hi @shtom
Try
your query....|rex field=ActiveLoadId "(?P<ActiveLoadId>.*)-"
Hi @shtom
Try
your query....|rex field=ActiveLoadId "(?P<ActiveLoadId>.*)-"
beautiful.....it worked