Hi- I have some strings separated by "." delimiter. For example,
I want to be able to extract the last two fields with the delimiter. So, I want my output to be:
Is there a method to perform such action?
How about trying this, let's say your data is in field
myField which has strings like
your query to return events | eval splitString=split(myField, ".") | eval count=mvcount(splitString) | eval requiredString=mvindex( splitString, count-2).".".mvindex(splitString, count-1) | table requiredString
This can also work, saves the "eval count=mvcount(splitstring)" clause
| eval splitString=split(myField, ".")
| eval requiredString=mvindex(splitString, -2).".".mvindex(splitString, -1)
| table requiredString
It appears the mvindex list can use negative indices to start from the end of the list.
An alternative command (rex). Assuming dot as delimiter. Regex might need updates based on type of values the string between delimiter contains.
your base search | rex field=myField "\.(?<requiredString>\w+\.\w+)$" | table myField requiredString
Building on somesoni2's expression, this would allow for any characters other than the delimiter:
your base search | rex field=myField "\.(?<requiredString>[^.]+\.[^.]+)$" | table myField requiredString