So far, I've had success with the following command:
eval Port=if(len(Port)>=22,substr(Port,1,len(Port)-2),Port)
This checks to see if a Sport result is >= 22, then subtracts 2 characters from the end. I get good results but they need to be specific to a particular search result.
The output I'm concerned with specifically is "Ethernet%" and everything else should be left alone by the above statement. I'm sure this is a simple fix, but I can't quite figure out how to put it all togehter...
I'm thinking it should start with:
eval Port=if(Port="Ethernet%" <--- from here, I'm a bit lost on how to put it together with the above statement.
@noob4now,
Try using nested if
| eval Port=if(match(Port,"Ethernet"),if(len(Port)>=22,substr(Port,1,len(Port)-2),Port),Port)