I have a need to ignore specific characters in my search results. I'm assuming this can be done with REGEX or something similar. Here is an example of what I need:
news%20article article%20about%20stuff 2014%20white%20paper.pdf
What I need it to look like is:
news article article about stuff 2014 white paper.pdf
Is this possible? If so can someone point me in the right direction?
Looks like sed will do the job.
... | rex field=<field> mode=sed "s/%20/ /g" | ...
@richgalloway how to replace mutiple characters separately using this or any other method. I want to replace both "abc" and "def" from the same field message
@ashimae, It's better to ask a new question than to add on to a old question with an accepted answer.
Have you tried using this same method with your data?
Yes it is possible, try something like this:
... | rex mode=sed "s/\%20/ /g"
this will search for all
%20 and replace it by a blank
hope this helps ...
I am facing similar issue:
":"04 : Capture card"," 24
":"05 : Do not honor"," 277
":"07 : Pickup card, special condition"," 7
":"12 : Invalid transaction"," 56
":"14 : Invalid card number","
04 : Capture card
05 : Do not honor
07 : Pickup card, special condition
12 : Invalid transaction
14 : Invalid card number
Query i am using:
"ADYEN JSON NOTIFICATION DATA" ("eventCode":"AUTHORISATION") ("merchantOrderReference":"AP") AND NOT Approved
| rex field=_raw "refusalReasonRaw(?.)billingAddress.stateOrProvince(?.*)" | stats count by REFUSALREASON
after refusalReasonRaw in the bracket, it is REFUSALREASON
after billingAddress.stateOrProvince in the bracket, it is Msg
I want expected o/p but somehow I am not able to figure out please help me!