Hello,
Apologies if this has been asked before (or if there is a much easier way of doing this), I haven't been able to identify any relevant posts elsewhere...
I've got a simple chart I'm trying to modify. Basically, it looks at a syslog message and charts the top 10 'x' based on the number of messages that have been generated.
Pseudo-search-code looks like:
Interesting_String_Value | top 10 field19
Now, what comes out of it is a chart (top 10) as you would expect, but the values look like:
field-description="actual_value"
I want to remove all pieces except for the actual_value (including quotations)
I'd assume I could handle this via rex mode=sed , but I'm not having any luck...
rex mode=sed 's/field-description\=//g;s/\"//g'
Help? : )
... View more