Hello,
I have a dashboard that I'm first appending to, example: |eval host=host." @ ".type which would result in myhost @ kc .
Then, I'm using a token to do a search, which would be index={myindex} source={mysource} $host$ * . I need to strip the host back to its original by removing the " @ kc" in this case.
I've tried the |makeresults "index={myindex} source={mysource} $host$ *" |rex mode=sed field=host "s/\s@\s\w+//g" but it won't return any results in my search.
Any help would be appreciated
... View more