Hello,
Could someone please advise of the most efficient way to trim off everything to the left of a "\" character in a field value?
Running into the escape character thing currently.
Have tried rex and its just too clumsy.
I would like to use something like: eval fieldA=ltrim(tostring(fieldA),"0")
-- putting the "\" characters in place of the "0" above proves no results.
Any ideas?
Thank you!
Like this:
| rex field=fieldA mode=sed "s/^[^\\\]*\\\/\\\/"
Replace /\\\/"
with //
to not keep the slash.
Like this:
| rex field=fieldA mode=sed "s/^[^\\\]*\\\/\\\/"
Replace /\\\/"
with //
to not keep the slash.
Yes!! 😄 Thx!! sed hurts sometimes.....
I didn't expect you to switch Accept
, but thank you!
I think I just stumbled across the cleanest output related syntax...
| eval fieldA=replace(fieldA,"(\w+)\\\\","+") | eval fieldA=ltrim(tostring(fieldA),"+")
thanks all!!
Actually, my answer is more efficient.