I have an query that
index ="main" |stats count by Text |sort -count | table count Text
results:
count | Text |
10 | b'dog fish |
20 | dog cat |
How can I drop " b' " prefix from the beginning of results (only from beginning , not replace into all string)
Try this
YOUR_SEARCH| eval Text=replace(Text,"(^([^']+)')","")
KV