How to hide some values in field?

[chakuttha]

When i have query data  result from search in field worker id it show >> domain\worker_id

search result Example  ABC\123456  it have domain name front of worker id.

If i would like to deleted only domain  ABC\  in field and result  show only number of worker id  .

Example    ABC\123456   >>> 123456

Please recommend  how to query in search.

Best Regards,

CR

[richgalloway]

There likely are several ways to do that.  Here are a couple

| replace "ABC\" with "" in worker_id

| rex mode=sed field=worker_id "s/ABC\//g"

[bowesmana · Accepted solution]

@chakuttha Those instructions from @richgalloway should have been

| rex mode=sed field=worker_id "s/ABC\\\\//g"

OR this

| replace "ABC\\*" with "*" in worker_id

There is a third option

| eval worker_id=replace(worker_id, "ABC\\\\", "")

Note in the middle one, the '\' character needs to be escaped ONCE for the SPL parser line, whereas in the rex and eval statements, the \ needs to be double escaped, once for the SPL parser line and secondly for the regex parser.

[chakuttha]

@bowesmana  It work. 

Thank you so much. 😄

[chakuttha]

Hi richgalloway  

I have try to do following your recommend it not work still show domain name front of worker id.

[johnhuang]

The solution posted by @richgalloway should have worked. The assumption is that "worker_id" is the actual fieldname you're trying to normalize, if not, you should change worker_id to the actual fieldname.

A more flexible way to do this esp when you have a multi-domain environment with local accounts is to extract the id with regex:

| rex field=worker_id "(?<worker_id>[^\\]*)$"