Could someone please advise of the most efficient way to trim off everything to the left of a "\" character in a field value?
Running into the escape character thing currently.
Have tried rex and its just too clumsy.
I would like to use something like: eval fieldA=ltrim(tostring(fieldA),"0")
-- putting the "\" characters in place of the "0" above proves no results.
I think I just stumbled across the cleanest output related syntax...
| eval fieldA=replace(fieldA,"(\w+)\\\\","+") | eval fieldA=ltrim(tostring(fieldA),"+")