Resolved with following:
replace “Document C_*” with “Document C” in <field name>
Resolved with following:
replace “Document C_*” with “Document C” in <field name>
You can rename fields like this
| rename Testing_Response as Testing
or if you are talking about changing the value of a field then there are various ways, but try this
| eval your_field=if(your_field="Testing_Response", "Testing", your_field)
In this scenario, the data is similar to this:
Document A
Document B
Document C_1425
Document C_2235
Document C_5134
I am grouping them together but due to the _number changing not matching it wont group them and I am looking to remove the _number from each one.
Here are two ways, using regex to do that
| makeresults
| eval Data=split("Document A,Document B,Document C_1425,Document C_2235,Document C_5134", ",")
| fields - _time
| mvexpand Data
| eval Data_Method_1=replace(Data, "_\d+$", "")
| eval Data_Method_2=Data
| rex field=Data_Method_2 mode=sed "s/_\d+$//"
so, you can either use replace() or rex mode=sed
Either way, you are defining the regex to remove what you don't want
As the value Document C_2235 would grow exponentially, would your example require me to enter all values?
I think you misunderstood the post - the search I gave was an example showing you how it works using your data. However, the solution is just the replace or rex statement - this regex is simply using a regular expression to remove the bits you don't want - i.e. _ followed by one or more numbers to the end of the string.
| eval Data_Method_1=replace(Data, "_\d+$", "")
Change 'Data' to your field name