Hey everyone. So what I need to do is complete the filename in one of my fields in an event. Example is this:
attachment = Filename ABC - 2019 111 CT.pdf
I am using the command: | rex mode=sed field=attachment "s/ /_/g" to replace the whitespace with underscores.
Question: How do I go about ignoring the whitespace before and after the dash. I am getting FilenameABC- 2019111_CT.pdf when it needs to be FilenameABC-2019111_CT.pdf
Any help would be great. Thank you!
Try this | makeresults | eval attachment="Filename ABC - 2019 111 CT.pdf" | rex mode=sed field=attachment "s/\s-\s/-/g" | rex mode=sed field=attachment "s/\s/_/g" | table attachment
Try this :
| makeresults | eval attachment="Filename ABC - 2019 111 CT.pdf" | eval attachment=replace(attachment,"\s-\s","-"),attachment=replace(attachment,"\s","_")
let me know if this helps!
Well, it's pretty simple,
replace is a text function of eval command. It has 3 arguments say, X, Y, Z. This function returns a string formed by substituting string Z for every occurrence of regex string Y in field value X.
Find a detailed explanation here: