When i have query data result from search in field worker id it show >> domain\worker_id
search result Example ABC\123456 it have domain name front of worker id.
If i would like to deleted only domain ABC\ in field and result show only number of worker id .
Example ABC\123456 >>> 123456
Please recommend how to query in search.
Best Regards,
CR
@chakuttha Those instructions from @richgalloway should have been
| rex mode=sed field=worker_id "s/ABC\\\\//g"
OR this
| replace "ABC\\*" with "*" in worker_id
There is a third option
| eval worker_id=replace(worker_id, "ABC\\\\", "")
Note in the middle one, the '\' character needs to be escaped ONCE for the SPL parser line, whereas in the rex and eval statements, the \ needs to be double escaped, once for the SPL parser line and secondly for the regex parser.
There likely are several ways to do that. Here are a couple
| replace "ABC\" with "" in worker_id
| rex mode=sed field=worker_id "s/ABC\//g"
@chakuttha Those instructions from @richgalloway should have been
| rex mode=sed field=worker_id "s/ABC\\\\//g"
OR this
| replace "ABC\\*" with "*" in worker_id
There is a third option
| eval worker_id=replace(worker_id, "ABC\\\\", "")
Note in the middle one, the '\' character needs to be escaped ONCE for the SPL parser line, whereas in the rex and eval statements, the \ needs to be double escaped, once for the SPL parser line and secondly for the regex parser.
@bowesmana It work.
Thank you so much. 😄
Hi richgalloway
I have try to do following your recommend it not work still show domain name front of worker id.
The solution posted by @richgalloway should have worked. The assumption is that "worker_id" is the actual fieldname you're trying to normalize, if not, you should change worker_id to the actual fieldname.
A more flexible way to do this esp when you have a multi-domain environment with local accounts is to extract the id with regex:
| rex field=worker_id "(?<worker_id>[^\\]*)$"