Trying to exclude a specific value from an extracted field

[srinivas_gowda]

Hello all,

I am trying to exclude an specific value within a field while retaining others. Can you please let me know.

Eg values:

1) /Server/Cpu/load/Login

2) /Server/Memory/usage

3)/Load/usage/value

These above are the values extracted form the event and I will have to remove only /Server value from the field while retaining all other values from the event.

Expected values needed:

1) /Cpu/load/Login

2) /Memory/usage

3) /Load/usage/value

Please help in getting this.

[ITWhisperer]

where field is the name of the field you want the replacement done

| eval field=replace(field,"\/Server","")

[skramp]

You can do it by replace command:

| replace "/Server*" with "*"