excluding a field value from a same events

[rajiv_r]

How can i exclude a single value from a field which generates multiple value in the single event.
for eg- if in a single event there are two values for the same field - user.purchase="TRUE" and user.purchase="False". If i have to exclude user.purchase="False' and need to display only user.purchase= " True" how can i do it.
I have already tried search user.purchase != "False" --- It dint worked.
I have also tried with NOT operator and Where command but nothing worked out.
Can someone please help me excluding this value

[to4kawa · Accepted solution]

....
|rex mode=sed field="user.purchase" "s/false//g"

[rajiv_r]

Thanks a lot this works

[richgalloway]

Try "user.purchase" != "false".

[rajiv_r]

I had already tried it..it dint work