hi
in my request, i have a sourcename like this
Microsoft Office 15(count: 1, percent: 50.0)
i want to delete : could you tell me how to do please : regex, HTML code?
thanks
thanks!!!!!!!
@jip31jip31, what is the field name? is it really source
or sourcename
like you have mentioned in your question?
Also do you want to make this correction during index time or search time?
If you want it during search time following is run anywhere search based on sample data provided in the question:
| makeresults
| eval sourcename="Microsoft Office 15(count: 1, percent: 50.0)"
| eval sourcename=replace(sourcename,":","")
@jip31 @jip31jip31 I have converted my comment to answer. If your issue is resolved please accept the answer to mark this question as answered!
nobody for helping me please???
Sorry but ko again....
try this
|table sourcename|eval sourcename=replace(sourcename,":","")
SORRY IT DOESN T WORK
Can you try something:
| rex field=sourcename mode=sed "s/://g"