Hi,
I want to replace the string "\x00" with spaces.
"CP REQUESTED \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" and i tried below commands but it didn't work.
rex mode=sed field=EXCP_MSG "s/\\x00/ /g"
replace \\x00 WITH " " IN EXCP_MSG|stats count by EXCP_MSG
Can anyone help me and also which command is better to use?
The first rule of RegEx and backslashes: if at first you don't succeed, add another backslash:
| makeresults
| eval EXCP_MSG="CP REQUESTED \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
| rename COMMENT AS "Everything above fakes sample data; everything below is your solution"
| rex mode=sed field=EXCP_MSG "s/\\\\x00/ /g"
The first rule of RegEx and backslashes: if at first you don't succeed, add another backslash:
| makeresults
| eval EXCP_MSG="CP REQUESTED \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
| rename COMMENT AS "Everything above fakes sample data; everything below is your solution"
| rex mode=sed field=EXCP_MSG "s/\\\\x00/ /g"
Thanks Woodcock