Hello All,
How can I remove words and characters from a multivalued field without using REX?
I have a filed named OS
OS:
Windows-2016
Windows-2010
How can I take out everything that comes in before the hyphen and just end up with the below?
OS:
2016
2010
Try mvmap and replace.
| makeresults
| eval OS="Windows-2016
Windows-2010"
| eval OS=mvmap(OS,replace(OS,"Windows-",""))
@richgalloway Your example doesn't create a mv-field but your solution works when the field is mv.
| makeresults
| eval OS=split("Windows-2016
Windows-2010" ,"
")
| eval OS=mvmap(OS,replace(OS,"Windows-",""))
Pretty close, just used mvindex instead. Thanks
| eval OS_Name=split(OSName,"-"), Env=mvindex(OS_Name, 1)