For example my field is file_name, which contain a string " Hi Hello Hi".
My search is file_name =hello | eval keyword = if(file_name== "hello" , "hello") | table keyword
this gives me an error which don let me create a new field call keyword with hello in it.
Can anyone help me with this?
Your problem is that you don't have a false option in the statement. Try adding one like this:
file_name =hello | eval keyword = if(file_name== "hello" , "hello","goodbye") | table keyword
If you would rather change the value in keyword only if file_name is "hello", and other wise use the contents of file_name then use this:
file_name =hello | eval keyword = if(file_name== "hello" , file_name) | table keyword
I believe you can do that with sed. With sed you can basically change the value that contains 'hello' to be just 'hello', and it works with wildcards.
Unfortunately, I don't know sed.
what are some ways i can do that?
No, you can't use wildcards like that.
Hi there,
Can i do something like file_name=star"hello"star
I keep getting error on this
sorry cant display star here thats why i put star