Hi!
I am changing a string in the host field of output with this format
ZX3B1093200198A
ZX3B1093200198B
The last alpha character is either 'A' or 'B'
(with that some might be able to guess what the platform is)
I can do precisely that with a simple sed
index=relevant index name sourcetype=relevant source type | rex mode=sed field=host "s/[A-B]$//"
That, not surprisingly, works. But I would like to do the same with rex, but without resorting to sed, which doesn't get used elsewhere.
This works;
index=relevant index name sourcetype=relevant source type | rex field=host "(?<host>.*).{1}"
But I want to specify that only the characters 'A' or 'B' (always uppercase) are removed if present.
I tried (?<host>.*[A,B]).{1} and a few other similar combinations but can't achieve that very last bit.
Any pointers or assistance gratefully received!
... View more