Id like to rename every instance of "dragDrop" to "stackDragDrop" from a multi-value field.
The search below just renames one instance. Any ideas on how to do this?
source="C:\\var\\regression_items\\*.xml"
| rex "title=\"(?P<id>\d+)\""
| rex max_match=0 "(class=\"stack\").+(data-type=\")(?P<STACK>\w+)(\")"
| eval TEST=mvfilter(STACK = "dragDrop")
| eval selectionElements=case(TEST="dragDrop", "stackDragDrop")
| table id selectionElements TEST
Try this
source="C:\\var\\regression_items\\*.xml"
| rex "title=\"(?P<id>\d+)\""
| rex max_match=0 "(class=\"stack\").+(data-type=\")(?P<STACK>\w+)(\")"
| eval TEST=mvfilter(STACK="dragDrop") |eval selectionElements=TEST | replace dragDrop with stackDragDrop in selectionElements
| table id selectionElements TEST
Try this
source="C:\\var\\regression_items\\*.xml"
| rex "title=\"(?P<id>\d+)\""
| rex max_match=0 "(class=\"stack\").+(data-type=\")(?P<STACK>\w+)(\")"
| eval TEST=mvfilter(STACK="dragDrop") |eval selectionElements=TEST | replace dragDrop with stackDragDrop in selectionElements
| table id selectionElements TEST
Perfect! I was missing replace. Thanks!