Trim string after second exclamation mark

[mandlikarbaaz]

Hi,
I have a field called SESSION_ID which has a value "0cdWYCu982HhTjoSYMUgnrCIW8c1apbU!1706637738!1581997108157"
I want to trim or modify the string from the second exclamation to the last to make it look like this "0cdWYCu982HhTjoSYMUgnrCIW8c1apbU!1706637738"
Can someone please help me out!

[vnravikumar]

Hi

Try this

| makeresults 
| eval SESSION_ID ="0cdWYCu982HhTjoSYMUgnrCIW8c1apbU!1706637738!1581997108157" 
| eval SESSION_ID=replace(SESSION_ID,"(![^!]+)$","")

[nickhills]

Try:

|rex field=SESSION_ID "(?P<NEW_SESSION_ID>[^!]+![^!]+)"

[nickhills]

If my answer helped, please consider accepting and/or upvoting so that other memebers of the community can see it was useful.