How to Parse response string value?

[pmjoen]

I have a log I am am trying to parse one of the responses

Field Value

Test Response

Response Test

Testing_Response

For the value "Testing_Response" I would like it to display "Testing" in the results.

[pmjoen · Accepted solution]

Resolved with following:

replace “Document C_*” with “Document C” in <field name>

[bowesmana]

You can rename fields like this

| rename Testing_Response as Testing

 or if you are talking about changing the value of a field then there are various ways, but try this

| eval your_field=if(your_field="Testing_Response", "Testing", your_field)

[pmjoen]

In this scenario, the data is similar to this:

Document A

Document B

Document C_1425

Document C_2235

Document C_5134

I am grouping them together but due to the _number changing not matching it wont group them and I am looking to remove the _number from each one.

[bowesmana]

Here are two ways, using regex to do that

| makeresults
| eval Data=split("Document A,Document B,Document C_1425,Document C_2235,Document C_5134", ",")
| fields - _time
| mvexpand Data
| eval Data_Method_1=replace(Data, "_\d+$", "")
| eval Data_Method_2=Data
| rex field=Data_Method_2 mode=sed "s/_\d+$//"

so, you can either use replace() or rex mode=sed

Either way, you are defining the regex to remove what you don't want

[pmjoen]

As the value Document C_2235 would grow exponentially, would your example require me to enter all values?

[bowesmana]

I think you misunderstood the post - the search I gave was an example showing you how it works using your data. However, the solution is just the replace or rex statement - this regex is simply using a regular expression to remove the bits you don't want - i.e. _ followed by one or more numbers to the end of the string.

| eval Data_Method_1=replace(Data, "_\d+$", "")

Change 'Data' to your field name