Hi,
I need a regex to extract at search time the values after ACTION[*] and up to the next character, regardless of whether its in quotes or not. So the values "100", or 'alter user blah identified by *' from the following examples;
ACTION:[3] "100" RETURNCODE:[1]
ACTION :[32] 'alter user scott identified by *' DATABASE
Thanks.
Hey
Try this
| rex field=_raw "ACTION\s\:\[\d+\]\s(?<YourFiledName>[\'|\"][^\'|\"]*[\'|\"])"
Hey
Try this
| rex field=_raw "ACTION\s\:\[\d+\]\s(?<YourFiledName>[\'|\"][^\'|\"]*[\'|\"])"
It nearly worked, extracted out the 'alter user scott identified by *' ok, but I didnt get "100" back as a value...
Yes, I missed a * in the first \s:
| rex field=_raw "ACTION\s*\:\[\d+\]\s(?<YourFiledName>[\'|\"][^\'|\"]*[\'|\"])"
Awesommmmmmme.
Worked perfectly. Many thanks.