Regex - Cannot extract terms with spaces

POR160893 — Sun, 25 Sep 2022 18:31:32 GMT

Hi,

I am using the following rex command to extract all text in between "....device-group:" and "succeeded ...." for a field called "old" and assigning the extracting values to a new field called "new".

| rex field=old "device-group:\s*(?<new>\S+)"

Currently, it is extracting all text in between "....device-group:" and "succeeded ...." EXCEPT for cases where there are multiple words with spaces.

Examples include:

1) "Panorama push to device:013101009509 for device-group: Austin Cloud DMZ succeeded. JobId=2484595" where the extracted values should be "Austin Cloud DMZ "

2) "Panorama push to device:013101014290 for device-group: Austin Bank Segmentation succeeded. JobId=2482583" where the extracted values should be "Austin Bank Segmentation"

Can you please help on extracting such cases too?

Thank you!

Re: Regex - Cannot extract terms with spaces

POR160893 — Sun, 25 Sep 2022 18:48:49 GMT

Solved it myself actually: | rex field=body "device-group:\s*(?<deviceGroup>.+?) succeeded"

topic Re: Regex - Cannot extract terms with spaces in Reporting

Regex - Cannot extract terms with spaces

Re: Regex - Cannot extract terms with spaces