About Scott_Wang

Scott_Wang · ‎07-29-2020

Hi @gcusello, I'm sorry. In the real case, the timestamp is not equal. So I cannot use BY _time... Any other ideas? What I'm trying to figure out is how to use xxx123 as a temporary value, and then whenever there is another document1 that occurs in new events, I can assign the value to the new events. Thank you.😁

renjith_nair · ‎07-07-2020

It's the third argument and its a reference group that are matched in the regex. So you can use it when your regex in the second argument results reference group. Here is a simple example |makeresults|eval text="first-second-third"|eval replacedText=replace(text,"(\w+)-(\w+)-(\w+)","\3-\2-\1")

Posts	5
Solutions	0
Karma Given	13
Karma Received	0
Member Since	‎06-20-2020

Online Status	Offline
Date Last Visited	‎07-29-2020 03:59 AM

Is it possible to save the value in a field in the...

Question about replace(X,Y,Z) function

Re: Is it possible to save the value in a field in...

Re: Question about replace(X,Y,Z) function