Is it possible to remove an asterisk from the returned data for a table

[ruhjuh]

Is it possible to remove an asterisk from the returned data for a table?

I tried to use:

rex "Data=(?<Message>[^C]+)\sC" 

however, this ends up cutting off some of the returned data for some lines. I also tried to do eval Message=REPLACE(DATA,"*"," ") and this threw an error.

The example of the returned data in a table would be:

ComputerName; XYZ User: ABC * File Sent to where it needs to go 

What I end up getting is not using anything is:

ComputerName;

Using the rex expression, I get:

ComputerName; XYZ User: ABC File

What I'm hoping to see is:

ComputerName; XYZ User: ABC File Sent to where it needs to go 

[ruhjuh]

I was able to get all the data displayed along with the asterisk by using |rex "DATA=(?[^$]+)"| where DATA was the indexed column. Then removed the asterisk with |eval Message=replace(Message, "\*", "")| Thanks to all that replied with ideas to help me resolve this issue i was having.

[woodcock · Accepted solution]

Like this:

... | rex field=DATA mode=sed "s/\*//g"

This will remove every asterisk character from the field DATA, regardless of where it may occur.

[slr]

Try with this:

rex field=FIELD "\w*[^\*]"

[ruhjuh]

Hello Sir, rex field=DATA "\w*[^\*]" threw an error -

Error in 'rex' command: The regex '\w*[^*]' does not extract anything. It should specify at least one named group. Format: (?...).

[slr]

The @woodcock answer is more accurate than mine, forget this 😉

[richgalloway]

I think you were close. Try eval Message=replace(DATA, "\*", "").

[ruhjuh]

Thanks for your reply richgalloway, when i tried that it just populated the table with the ComputerName.