I've tried inserting eval first_line=mvindex(split(_raw,"\n"),0) in the pipeline, but that doesn't seem to do the trick.
As far as I can tell, "\n" does not actually denote a one-character string that is a newline. How can I do that?
Since I'm trying to discard the remaining lines and am passing the result of the above through a replace() anyway, I first tried a regex (directly on _raw ) ending with (?:\n|.)* as recommended elsewhere, but that didn't work.
At least with the above, I'm able to extract the desired field and replace the whole thing with just that field (for eval of a new variable) -- though I don't understand why, because when I change my table to emit first_line instead of _raw , it still shows up with the subsequent, unwanted, lines.
... View more