Hello, I have a lookup file with data in following format
name _time srv-a.xyz.com 2017.07.23 srv-b.wxyz.com 2017.07.23
I want to replace .xyz.com with wxyz.com
My replace query does this c...
Hello, I need to remove the values found (string) from another field. Ex. FIELD1 - abcmailingxyz LIST - mailing, ... Using | eval foundIt=if(match(FIELD1,$LIST$),"X",".") I am able to...
Hi
Has anyone seen this before, I'm using DB connect to pull data in from a MySQL db, and this is the results shown in the data lab
but the raw events have the training zero's replaced w...
Hi all, I have an alert that looks for a specific message that includes the record ID. I would like to be able to create a numeric value for that ID that could be used to create a unique ID when ra...
Hi guys, I'm trying to replace values in an irregular multivalue field. I don't want to use mvexpand because I need the field remains multivalue. Here some examples of my multivalues fields #1 1...
...3d6e06734ae
}
I want to replace the ids into https://mywebsite/v1/organization/{id}/buildings
I tried {base search string} | eval endpoint=replace(properties.url, "\d+", "{id}") | stats by endpoint&n...
...d}
wapi/v3/gat/{Id}/cust/api
Basically in the fields , it should only take alphapets (including that v3) and we should replace digits to {Id} whereever it exist .
Can someone h...
I had a field of this value
nameSpaces = ["url1"]
nameSpaces = ["url1", "url2"]
I got rex to change ["url1", "url2"] into "url1, url2"
However, I am trying to change url1 to a labe...
How can we use case insensitive value in Replace command-
| replace "name" with "entity" in description
will it replace name , NAME, Name, NaMe etc with entity ????
If not how can we i...
Background
I have a log file where I have extracted some fields. I am trying to parse a field to get the numeric values it has using replace but it is not working and I don't understand why.
P...