This function removes the trim characters from the right side of the string. If the input is the return value would be. The following example returns the values in the date field, with the month and day numbers switched. The eval expression performs one level of escaping before passing the regular expression to PCRE. This is because the replace function occurs inside an eval expression. To replace a backslash ( \ ) character, you must escape the backslash twice. The argument can also reference groups that are matched in the using perl-compatible regular expressions (PCRE) syntax. This function substitutes the replacement string for every occurrence of the regular expression in the string. | eval cost=ltrim(NET_COST, "$") replace(,) Description The following example removes the dollar sign ( $ ) from the results for the NET_COST field. The value that is returned is x="abcZZ ". The following example trims the leading spaces and all of the occurrences of the letter Z from the left side of the string. If not specified, spaces and tabs are removed from the left side of the string. The argument can be the name of a string field or a string literal. This function removes characters from the left side of a string. | eval username=lower(username) ltrim(,) Description The following example returns the value provided by the field username in lowercase. You can use this function on multivalue fields. This function takes one string argument and returns the string in lowercase. The results show a count of the character length of the values in the names field: You can determine the length of the values in the names field using the len function: Suppose you have a set of results that looks something like this: This function is not supported on multivalue fields. You can use this function with the eval, fieldformat, and where commands, and as part of eval expressions. This function returns the character length of a string. Here's an example:Įither method returns a field called ipclass that contains the class portion of the IP address.The following list contains the functions that you can use with string values.įor information about using string and numeric fields in functions, and nesting functions, see Evaluation functions. You can use a forward slash ( / ), instead of quotation marks, to enclose the expression that contains a character class. You can escape the backslash character by enclosing the string in quotation marls and adding another backslash to the character class, as shown in this example: You can specify the expression in one of two ways. However, the expression uses the character class \d. You want to extract the IP class from the IP address. In this example, the clientip field contains IP addresses. Regular expressions with character classes | rex field=ccnumber mode=sed "s/(\\d/XXXX-XXXX-XXXX-/g" 2. The \d must be escaped in the expression using a back slash ( \ ) character. In this example the first 3 sets of numbers for a credit card are masked. Use a to match the regex to a series of numbers and replace the numbers with an anonymized string to preserve privacy. To learn more about the rex command, see How the rex command works. The following are examples for using the SPL2 rex command.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |