I want to display each event's raw text in a table column, but I need to remove the first four lines of the field (terminal_id, operator_id, date, and time lines). Is there a way I can always 'hide' the first four lines of the field before displaying it in a dashboard table at searchtime?
This is what the field looks like:
CA7_TERMINAL_ID= data here!
It really, really, really, really helps to see you raw events and your search. Because you keep referring to this dataset as a field I am assuming that this is a single event and that you need to strip out that data. This seems unlikely but...
Your Search Here
| rex field=YourFieldNameHere mode=sed "s/^.*?CA7_TIME=[^\n\r\s]+//"