Replace square brackets and leave original value

[korstiaans]

Hi All,

I have a field with the following value:

[ "842cef72-745d-463c-8b49-ce16ccc5ebd2" ]

I'd like to get rid of the square brackets and the quotes ending up with:

842cef72-745d-463c-8b49-ce16ccc5ebd2

[michel_wolf]

Hi korstiaans,

you can try this:

|makeresults
|eval sample_field="[ \"842cef72-745d-463c-8b49-ce16ccc5ebd2\" ]"
|rex field=sample_field "\[\s\"(?<new_field>.*)?\""

I don´t know if you have realy spaces between the [ and "

Michel

[clintla]

(?<CAPTURE>[a-z0-9-\]+)

[clintla · Accepted solution]

Sorry- added incorrectly \

(?<CAPTURE>[a-z0-9-]+)

[korstiaans]

@clintla Thanks, works like a charm. 

[korstiaans]

Hi Michel,

That doesn't work, but it's probably, because the field is a little weird formatted. It looks like this in a table: