I have a string field that I split into a variable-length multi-value, removed the last value and need to combine it back to a string value. The search below doesn't seem to work
e.g.:
url
/user/v1/group/status/313
/prov/provisioning/v1/group/30863
search:
eval n_url= split(url, "/") |eval o_url=(mvindex(n_url,1,mvcount(n_url)-2)) |mvcombine delim="/" n_url | nomv n_url | table url, m_url, o_url
Why don't you try this?
| makeresults
| eval url="/user/v1/group/status/313 /prov/provisioning/v1/group/30863"
| makemv url
| mvexpand url
| rex field=url mode=sed "s/(.*)(\/\d+)/\1/g"
By your method you should try
| eval n_url= split(url, "/")
| eval o_url=(mvindex(n_url,1,mvcount(n_url)-2))
| mvexpand o_url
| mvcombine delim="/" o_url
| nomv o_url
| table url o_url n_url