We have the DNS debug logs coming onto the indexer.
Now each events will have an alpha-numeric pattern for 'domain name' in below fashion
**(1)abc(2)def(3)ghif(4)**
Now i want the **highlighted** data to be altered to a different format
I have used the below SEDCMD in props.conf but is does not seem to alter it as required
SEDCMD-win_dns = s/\(\d+\)/./g
Expectation: abc.def.ghif
Reality: .abc.def.ghif.
so it basically replaces all the '(digits)' with '.' But i want the extreme-placed integers to be converted to white space character
Is that possible?
↧