Hello Everyone,
I have a file containing Account ="xxx/\xxx/\xxx/\xx"
value and this needs to be concatenated with a string, say "my account" .
when i tried following search:
index=myindex | eval description= "my account" + Account | table description
getting blank for "description" .
Can any one guide me where aI'm going wrong ??? or this is because of the "/\" character in the string?
Thanks
Hello All,
Thanks for your reply, the problem was Account string contain the two values with line break. so i used mvjoin
command to remove line and now it is working perfectly fine.
Once again thanks all !!
Hello All,
Thanks for your reply, the problem was Account string contain the two values with line break. so i used mvjoin
command to remove line and now it is working perfectly fine.
Once again thanks all !!
Do the quote characters show up in the Account field? If so I wonder if that is throwing it off. Maybe try the following before your eval
... | rex field=Account "\"(?<Account>[^\"]+)" | ...
I don't think the characters will matter.
To prove this, try replacing them with something else?
index=myindex | eval rfield=REPLACE(Account, "/", "-") | eval description="my account" + rfield | table description
Thanks for reply @kendrickt.. same not getting display !!!
use .
index=myindex | eval description= "my account".Account | table description
Thanks for reply @mzorzi. but it is not working.
Can you paste what the output of the below code looks like?
I did a quick test of the code above and it seems to work fine
index=myindex | table Account
Thanks for reply @ramdaspr. the problem was this string it contain line break, so it was not coming. i used "mvjoin" command for removing line. that it worked !!! 🙂