In a service log different API being invoked each API start with ~( like ~getenrolled, ~enroll, ~submit) so is there any way to extract first API being called by rex
i tried (~\w+){1} but it matching with all called API .
Like this:
... | rex "~(?<FirstAPIName>\w+)"
Unfortunately it will match all called api (started with ~+API name )
I wanted to extract first matched api which is the main api call subsequent are sub api in service log .
Then this:
... | rex max_match=1 "~(?<FirstAPIName>\w+)"
Based on the sample data provided please try the following rex
command with max_match=1 (which is by default):
| makeresults
| eval _raw="~getenrolled, ~enroll, ~submit, ~somethingelse, ~somethingnew"
| rex "~(?<FirstAPIName>[^,]+)," max_match=1
Alternatively, you can also use caret sign ( ^ )
if you want to extract required API Name only from beginning of raw data (depends on the data, if this does not work please provide sample raw data)
| makeresults
| eval _raw="~getenrolled, ~enroll, ~submit, ~somethingelse, ~somethingnew"
| rex "^~(?<FirstAPIName>[^,]+),"
PS: First two pipes with makeresults
and eval
are used to generate mock data for testing regular expression.