I'm currently trying to join two log events across separate sources using their file name. The issue i have run in to is that within one log set the spaces in file names are replaced by underscores (for instance "abcd efg.csv" becomes "abcd_efg.csv") whereas the other source maintained the spaces ("abcd efg.csv" remains "abcd efg.csv").
As a result i'm not able to join on the filename. Can anyone help is an expression that would edit the values for the filename field. I'm thinking some kind of eval that replaces any spaces it finds with underscores, however i've not come across away to do this.
Your assistance would be much appreciated.
** Issue resolved using replace **
| rex "(?i)\/xyz\/\w+\/(?P.+).(csv|xls)" | eval FileNameNoSpaces = replace(FileName,"\s","_")
FileNameNoSpaces can then be used to join effectively.
... View more