How to trim column in table?

[naujla85]

Hello, 

I am running the following query. 

index=sys_tools_ecc-appd application_name=CAPRI-1130 | table * | search source=business_transactions business_transactions.metricName="*Average Response Time (ms)*" | timechart avg(business_transactions.metricValues{}.value) by business_transactions.metricPath

The business_transactions.metricPath names are all too long example below:

1. Business Transaction Performance|Business Transactions|APP|/dbq/ecrud|Average Response Time (ms)

2. Business Transaction Performance|Business Transactions|APP|/dbq/BTSXDRRequest_PortTypeWS|Average Response Time (ms)

Need to trim them from both side. I need to remove  "Business Transaction Performance|Business Transactions" from the front and "|Average Response Time (ms)" from the back before displaying them on column. 

[richgalloway · Accepted solution]

Use an AS clause in the timechart command to specify a shorter name for the average value field.

| timechart avg(business_transactions.metricValues{}.value) as avgMetricValue by business_transactions.metricPath

Or use rename

| rename "Business Transaction Performance|Business Transactions|*|Average Response Time (ms)" as *

[naujla85]

second solution worked for me thank you!!!!!

[ITWhisperer]

Try something like this before the timechart command

| eval business_transactions.metricPath=replace(business_transactions.metricPath,"Business Transaction Performance\|Business Transactions\"","")
| eval business_transactions.metricPath=replace(business_transactions.metricPath,"\|Average Response Time (ms)","")

[naujla85]

its showing me null value.