I want to remove a number (up to 5 digits) from a string on its beginning.
43.aaaa_vvvvv.cccccc:dddddd => aaaa_vvvvv.cccccc:dddddd
9374.aaaa_vvvvv.cccccc:dddddd => aaaa_vvvvv.cccccc:dddddd
1.aaaa_vvvvv.cccccc:dddddd => aaaa_vvvvv.cccccc:dddddd
I only need to remove the first number and the "." after it.
@matansocher, is this a field or raw data?
You can try the following rex command:
<your base search>
| rex field=_raw "\d+.(?<myData>.*)"
| table _raw myData
I have use field name as _raw but you can replace with your own if it is some other field. Alternatively you can also use replace() command with regular expression if this is a field.
View solution in original post
Try the regex below. Let me know if this works.
index=xyz| rex field=_raw "^(?P[^.]+)"
This produces this message:
"Error in 'rex' command: Encountered the following error while compiling the regex '^(?P[^.]+)': Regex: unrecognized character after (?P"