Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

replace_string doesn't work when string to replace contains parens #16

Open
flysand7 opened this issue Aug 23, 2024 · 0 comments
Open

Comments

@flysand7
Copy link

flysand7 commented Aug 23, 2024

The replace_string function doesn't seem to be working when the string to replace contains parens. In the example below I'm trying to clear the substring (NoData) from the value of a specific JSON field. If, instead, I try to clear just the text inside the parens (i.e. NoData), then UQL returns the expected json value, which leads me to believe the parens are at fault here.

The failing case occurs on the following JSON:

{"alert_state": "Normal (NoData)"}

With the following UQL query:

parse-json
| extend "alert_state"=replace_string("alert_state", ' (NoData)', '')

The query returns the same JSON that was passed in, suggesting that nothing has changed about the alert_state string.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant