followed the escaped error: "An error has happened executing a dash statement. hello good morning
followed the escaped error: "6g is not a valid for Value of the statement. happy morning
Can you try replace command -
E.g.
| makeresults | eval text="followed the escaped error: \"An error has happened executing a dash statement. hello good morning" | eval text=replace(text,"\:[^\.]+","")
Like this:
| makeresults
| eval text="followed the escaped error: \"An error has happened executing a dash statement. hello good morning"
| rex field=text mode=sed "s/\:[^\.]+//"
Can you try replace command -
E.g.
| makeresults | eval text="followed the escaped error: \"An error has happened executing a dash statement. hello good morning" | eval text=replace(text,"\:[^\.]+","")
it should not cut other following fields only it should till dot