Hi all,
I have some value under geologic_city fields as below, but it has some problems. For example, actually Anshan and Anshan Shi is the same city, and i have multiple cities have this issue. I want to remove all "Shi" if the string has. Can anyone help me on this?
Thanks
Try this:
| eval geoloc_city = trim(replace(geoloc_city, "Shi", ""))
Careful as it is case sensitive
EDIT. You can have a more granular control (including case insensitive mode) by using rex:
| rex field=geoloc_city "(?i)^(?<geoloc_city>.+?)(\sShi)?$"
Try this:
| eval geoloc_city = trim(replace(geoloc_city, "Shi", ""))
Careful as it is case sensitive
EDIT. You can have a more granular control (including case insensitive mode) by using rex:
| rex field=geoloc_city "(?i)^(?<geoloc_city>.+?)(\sShi)?$"
Thanks a lot javiergn, it works!