topic Re: Regex to extract quoted text aftera stats command in Reporting

Regex to extract quoted text aftera stats command

cindygibbs_08 — Tue, 22 Jun 2021 22:30:54 GMT

I hope everyone is having a great time today,
I am here to first thank you guys for being so helpful and assertive! you people rock! and second to ask for assistance regarding a regular expression.
I have a field that will contain a string that will start by "check-in unavailable due to external cause the ref code is ##AIUI- 989 K-IOJ##"
I want to be able to extract the string that is between the "##" but... sometimes this field may have a string that starts by "the auth was..." I want to be able to extract any string between two "#" whenever the value of the field starts with "check-in unavailable due to external cause the ref code is"

for example
if I have this:

FIELD	CODE
"check-in unavailable due to external cause the ref code is ##AIUI- 989 K-IOJ##	AIUI- 989 K-IOJ
"the auth was denied code ## uik-55855##"	N.A

thank you guys SO MUCH

Kindy,

Cindy

Re: Regex to extract quoted text aftera stats command

ITWhisperer — Tue, 22 Jun 2021 23:12:31 GMT

| makeresults | eval _raw="check-in unavailable due to external cause the ref code is ##AIUI- 989 K-IOJ## the auth was denied code ## uik-55855##" | multikv noheader=t | fields _raw | rex "check-in unavailable due to external cause the ref code is ##(?<code>[^#]+)##"

Re: Regex to extract quoted text aftera stats command

cindygibbs_08 — Wed, 23 Jun 2021 01:02:58 GMT

@ITWhisperer I am in love with you

Re: Regex to extract quoted text aftera stats command

cindygibbs_08 — Wed, 23 Jun 2021 01:15:20 GMT

I have a question what would the rex function will look like if instead of two "#" the coude would come inside two "*" like this : **UID J- DIDD**, I would just change the "#" by "*"??

Re: Regex to extract quoted text aftera stats command

ITWhisperer — Wed, 23 Jun 2021 07:29:37 GMT

Thanks Cindy ❤️😁

Re: Regex to extract quoted text aftera stats command

ITWhisperer — Wed, 23 Jun 2021 07:34:03 GMT

Asterisks "*" have special meaning in regex so each would need to be escaped with a backslash "\"

| makeresults | eval _raw="check-in unavailable due to external cause the ref code is **AIUI- 989 K-IOJ** the auth was denied code ** uik-55855**" | multikv noheader=t | fields _raw | rex "check-in unavailable due to external cause the ref code is \*\*(?<code>[^\*]+)\*\*"