below is my search
source=abc-server
I want to trim "-server"
and I tried this
| eval source=trim("abc-server", "-server")
did not work any idea how to do this?
Hi navins007,
the easiest way is a regex:
| rex field=source "(?<source>[^-]*)-server"
or, if the string before "-server" has a fixed lenght
| eval source=substr(source,1,string_lenght)
but regex is better and more efficient!
Bye.
Giuseppe
thanks cusello and kamlesh, i will try your suggestions.
Hi
Can you please try below search?
YOUR_SEARCH | rex field=source "(?<source>.*)\-.*"
Thanks