I want to remove the numeric value and comma which is occurring on the first line beginning
1,Woolworths appoints new chief executive
2,Retailer Woolworths has appointed Roy Bagattini as its new group chief executive officer (CEO), with former chief Ian Moir set to step down on 16 February.
123,Walmart is joining Albertsons and Kroger
Hi @premranjithj
Try something like this:
your search...|rex field=_raw "^\d+\,(?P<text>.+)$"
If that original string is already extracted to another field, replace _raw
with your fieldname.
Let me know if that works!
https://regex101.com/r/W7Ea2p/1
Hi @premranjithj
Try this
| makeresults
| eval string="1,Woolworths appoints new chief executive#
2,Retailer Woolworths has appointed Roy Bagattini as its new group chief executive officer (CEO), with former chief Ian Moir set to step down on 16 February.#
123,Walmart is joining Albertsons and Kroger"
| makemv delim="#" string
| mvexpand string
| eval temp=split(string,",")
| eval result=mvindex(temp,1) |table result
Where does the '#' comes from?
For creating dummy event I had added # in the text to break
@vnravikumar thanks it worked
Hi @premranjithj
Try something like this:
your search...|rex field=_raw "^\d+\,(?P<text>.+)$"
If that original string is already extracted to another field, replace _raw
with your fieldname.
Let me know if that works!
https://regex101.com/r/W7Ea2p/1
@nickhillscpl cool ! worked , thanks