Extesnded value Associaated With destiny: "LineIces" - "Actio1n Cod2e"; Modified: Extends Aribute - "Action"; Old Value = "Add"; New Value = "-" Modified
Like this:
| rex field=ER mode=sed "s/Modified\S+.*$//g "
But maybe the \S
should be \s
so try this if that doesn't work:
| rex field=ER mode=sed "s/Modified\s+.*$//g "
Or maybe actually this:
| rex field=ER mode=sed "s/Modified:\s+.*$//g "
Like this:
| rex field=ER mode=sed "s/Modified\S+.*$//g "
But maybe the \S
should be \s
so try this if that doesn't work:
| rex field=ER mode=sed "s/Modified\s+.*$//g "
Or maybe actually this:
| rex field=ER mode=sed "s/Modified:\s+.*$//g "
Can you provide a sample, what the event is and what you want to extract out of that event ?
i want to cut\remove all the character when "Modified" is Present.
EX : Extesnded value Associaated With destiny: "LineIces" - "Actio1n Cod2e"; Modified: Extends Aribute - "Action"; Old Value = "Add"; New Value = "-" Modified
So if there is field A . When word "Modified" in NOT present in the event, value of A="Add" and when word "Modified" is present is the event, value of A="-" . Is this what you want ?