topic Rex command in Dashboards & Visualizations

Rex command

prasant — Mon, 08 Nov 2021 03:47:06 GMT

Need help to extract value between 2 fields eg: below

"status":"Active",
"birthDate":"xxxx-03-06",

I am trying below

rex field=details "\"status\"\:\"(?<contactStatus>[^\n\r\",]+)*\"birthDate\""

NOTE: there is another status field, so I am trying to use this option, as I know "birthDate " follows "status" field.

Thanks for you help in advance

Re: Rex command

bowesmana — Mon, 08 Nov 2021 05:38:40 GMT

User (?s) for matching newline by . character. Try this

| makeresults | eval details="\"status\":\"Active\", \"birthDate\":\"xxxx-03-06\", \"status\":\"otherstatus\"" | rex field=details "(?s)\"status\"\:\"(?<contactStatus>[^\"]*).+\"birthDate\""

Re: Rex command

prasant — Mon, 08 Nov 2021 23:53:04 GMT

Thanks,,, I used below "\"status\":\"(?<contactStatus>[^\n\r\"]*)\",\"birthDate\"", it also worked.