How to replace/remove a specific character?

[RRajneesh]

Hi,

I have the below output :

"(|01/01/16|01/01/18|01/05/18|04/02/18|05/01/17|05/05/16|05/08/17|)"

The desired output is to remove the first and last '|' : "(01/01/16|01/01/18|01/05/18|04/02/18|05/01/17|05/05/16|05/08/17)"

My below code isn't working, can you please help me?

Let's say search = "(|01/01/16|01/01/18|01/05/18|04/02/18|05/01/17|05/05/16|05/08/17|)"

| eval search = replace (search , "(|" , "(")
| eval search = replace (search , "|)" , ")")

Error : Error in 'eval' command: Regex: missing closing parenthesis

[woodcock]

Like this:

| makeresults
| eval test = "(|01/01/16|01/01/18|01/05/18|04/02/18|05/01/17|05/05/16|05/08/17|)" 
| rex field=test mode=sed "s/\(\|/(/ s/\|\)/)/"

[wrangler2x]

If this is not a one-time thing, you could also make this replacement before ingesting the data by putting this sed in props.conf on the indexer, or even better on the forwarder:

[sourcetype]
SEDCMD-xyz s/\(\|/(/ s/\|\)/)/

[aholzer · Accepted solution]

You have to escape the characters in your regex:

| makeresults 1 
| eval test = "(|01/01/16|01/01/18|01/05/18|04/02/18|05/01/17|05/05/16|05/08/17|)"
| eval test1 = replace (test , "\(\|" , "(")
| eval test2 = replace (test1 , "\|\)" , ")")

Hope this helps

[RRajneesh]

Thanks. - I tried it and it worked.