Hello,
I Googled **and** searched the Answers forum, but with no luck.
Below, in psuedo code, is what I want to accomplish.
*eval newfield if oldfield starts with a double quote, newfield equals oldfield; if not, run a rex on oldfield.*
I have the code for the rex from hex to text.
| rex mode=sed field=cmd "s/([0-9A-Fa-f]{2})/%\1/g" | eval cmd=urldecode(substr(cmd,1))
What I am looking for is how to search for a field containing double quotes using an if statement, and run the rex command if the field doesn't contain double quotes.
Example of two different values for old field and the result I need on newfield.
oldfield **"dmidecode"**
newfield **"dmidecode"** or **dmidecode**
oldfield **7375202D**
newfield **su -**
Thanks and God bless.
Genesius
↧