I want to strip certain characters from my data on input. It changes the _raw data, but not the search time extracted fields. In particular I have a field 'Asset_Title' that I want to change certain chars in, so in props.conf I have
SEDCMD-Asset_Title = s/MP/ZZ/g
So, I see the raw data has all the MP changed to ZZ, but the field, 'Asset_Title' still shows the field with the MP.
I don't understand that and I am also not sure what the
Also, now search Asset_Title=M* shows the titles starting with M, but search Asset_Title=MP* finds no hits and search Asset_Title=ZZ* also finds no hits. Uh???
The
If you want to change only the Asset_Title field in your events, you should do something like this:
SEDCMD-title = s/Asset_Title=(MP)/Asset_Title=ZZ\1/g
The ZZ will replace what's in the capture group (MP in this case). You'll have to adjust the regex to match the values in the Asset_Title field, as I'm sure the above example won't quite do it. If you want to post an example of your data, I can post a more accurate answer.
Yes, I think this syntax is probably best then:
SEDCMD-
At the bottom is a line of data and what I am actually trying to do is replace any U+2018 or U+2019 chars with a 0x27. The first Field is Asset_Title and contain Tap 'n Print, where the ' is U+2018, so my SEDCMD is
SEDCMD-Asset_Title = s/(‘|’)/'/g
I used MP and ZZ as a proof of concept. I guess I could probably use the y/‘’/''/
Tap 'n Print,_scorm12_sppubknowledgera_o254ao,Custom Asset,username,FirstName,LastName,Vietnam,RVX125,0,2013-05-28,2013-07-22,41,0,,2013-07-22,Completed,,90.00,90.00,20,1670,Direct sales