I'm hoping that someone can help me with a regex.
Here's the source data:
<OTHERFIELD>some values</OTHERFIELD><COMPID>string1 node 1</COMPID><MOREOTHERFIELDS>more values</MOREOTHERFIELDS>
I need to extract everything between the COMPID brackets. I have the following, but it's grabbing the extra bracket at the end.
REGEX = \<COMPID\>(?<dvcTEST>\w*\s)
I've tried regex101 site, but wasn't able to get it right.
This is in transforms.conf, so where would the field get defined? I tried that, it errors out when restarting the search-head:
REGEX = \<COMPID\>(?[\w\s]+)<\/COMPID>
Hi @a212830 ,
I would do this as a one-liner in props.conf:
EXTRACT-compid = \<COMPID\>(?<dvcTEST>[^\<]+)\<\/COMPID\>
But if you REALLY want to do it in props.conf & transforms.conf:
REPORT-extractcompid = extractcompid
REGEX = <COMPID>(?<dvcTEST>[^<]+)<\/COMPID>
FORMAT = dvcTEST::$1
Thanks. I like that better. What if I just wanted the first word between the brackets? I have similiar ones where only the first word is needed.
Tried this, but it didn't work:
EXTRACT-testcompid = \<COMPID\>(?<testdvc>\S+)\<\/COMPID\>
I'm trying to get the first word between the COMPID brackets.