Hi,
I have a field EMP, I need to remove the 0000 present before the field, is this do able?
like, I'm using Rex and ltrim
|rex field=EMP "(?\d{5})$"|eval EMP=if (like (EMP,"0000%"),ltrim(EMP,"0000\\"),EMP)
EMP:
000012345
000000002(its removing all 0's but i need 00001)
0000ABCDEFGH
Expected output;
12345
00002
ABCDEFGH
try something like this,
|stats c |eval f="000012345,000000002,0000ABCDEFGH,100000" |eval field=split(f,",") | fields - f | mvexpand field |rex mode=sed field=field "s/^(0000)(.*)/\2/g"
@kiran331 - Did one of the answers below help provide a solution your question? If yes, please click “Accept” below the best answer to resolve this post and upvote anything that was helpful. If no, please leave a comment with more feedback. Thanks.
Like this:
.... | rex field=EMP mode=sed "s/^0000//"
This makes test data -
| makeresults | eval EMP="000012345 0000ABC 000000002 george" | makemv EMP| mvexpand EMP
this answers the question
| eval EMP2=if (like (EMP,"0000%"),substr(EMP,5,len(EMP)-4),EMP)
| table EMP EMP2
With this result
EMP EMP2
000012345 12345
0000ABC ABC
000000002 00002
george george
try something like this,
|stats c |eval f="000012345,000000002,0000ABCDEFGH,100000" |eval field=split(f,",") | fields - f | mvexpand field |rex mode=sed field=field "s/^(0000)(.*)/\2/g"