Is it possible to remove an asterisk from the returned data for a table?
I tried to use:
however, this ends up cutting off some of the returned data for some lines. I also tried to do
eval Message=REPLACE(DATA,"*"," ") and this threw an error.
The example of the returned data in a table would be:
ComputerName; XYZ User: ABC * File Sent to where it needs to go
What I end up getting is not using anything is:
Using the rex expression, I get:
ComputerName; XYZ User: ABC File
What I'm hoping to see is:
ComputerName; XYZ User: ABC File Sent to where it needs to go
I think you were close. Try
eval Message=replace(DATA, "\*", "").
Thanks for your reply richgalloway, when i tried that it just populated the table with the ComputerName.
rex field=DATA "\w*[^\*]" threw an error -
Error in 'rex' command: The regex '\w*[^*]' does not extract anything. It should specify at least one named group. Format: (?...).
... | rex field=DATA mode=sed "s/\*//g"
This will remove every asterisk character from the field
DATA, regardless of where it may occur.
I was able to get all the data displayed along with the asterisk by using
|rex "DATA=(?[^$]+)"| where DATA was the indexed column. Then removed the asterisk with
|eval Message=replace(Message, "\*", "")| Thanks to all that replied with ideas to help me resolve this issue i was having.