I have a regex that should remove everything after a second underscore. When I try to search with the regex, it doesn't work. Any ideas? I must be doing something wrong, just can't figure out what.
Data looks like this:
AB200_Cdef_233
Abcde_FG400_34
And should end up looking like this:
AB200_Cdef
Abcde_FG400
index=cms_vm
| eval DatastoreName=replace(DatastoreName,"^[^_]*_[^_]*\K.*$")
| table DatastoreName
| dedup DatastoreName
| sort DatastoreName
↧