How can i exclude a single value from a field which generates multiple value in the single event.
for eg- if in a single event there are two values for the same field - user.purchase="TRUE" and user.purchase="False". If i have to exclude user.purchase="False' and need to display only user.purchase= " True" how can i do it.
I have already tried search user.purchase != "False" --- It dint worked.
I have also tried with NOT operator and Where command but nothing worked out.
Can someone please help me excluding this value
....
|rex mode=sed field="user.purchase" "s/false//g"
....
|rex mode=sed field="user.purchase" "s/false//g"
Thanks a lot this works
Try "user.purchase" != "false"
.
I had already tried it..it dint work