hi all,
i have one filed called value, it is a value like : 1006718, but it contains two information, 10067 is the real score, 18 is another filed called steps. May i know how can I separate this value into two fields, one is called real_value, another is called move_steps?
my search:
(label="Score*") value |stats count(_raw) by value |rename value AS Score
my result:
Score
1006718
Hi,
This regular expression is only valid if the value of steps
always corresponds to the last two digits of value
:
... |rex field=value "^(?<score>\d*)(?<steps>\d\d)$"
If steps
can consist of one digit or more than two digits, then you can only guess.
Hi,
This regular expression is only valid if the value of steps
always corresponds to the last two digits of value
:
... |rex field=value "^(?<score>\d*)(?<steps>\d\d)$"
If steps
can consist of one digit or more than two digits, then you can only guess.
Hi echalex,
Thanks for your help, it really works.
Best Regards
hqw
Does the value have fixed format (in your example it's 7 digits format)?