Hi guys,
Tried my best googling an answer but have not been able to find something that fits my requirement.
I have the following raw_data:
... \"number_of_goods\":10,\"number_of_locations\":5, ...
How do I create a field called number_of_goods and number_of_locations where the value is 10 and 5?
Many thanks in advance!
Try the rex
command. The backslashes are needed to escape the backslashes and quotes in your data.
<your search> | rex "number_of_goods\\\\\":(?<numberOfGoods>\d+),\\\\\"number_of_locations\\\\\":(?<numberOfLocations>\d+)" | ...
It works, you really saved my day. I have one follow-up question though. I'm trying to extract a similar field but it has a decimal value, e.g. 0.25 and with the rex example I got from you, I only get the first digit before the decimal and I can't figure out how to get the full value.
The regex for a floating point number is \d+\.\d+
.
If your problem is resolved, please accept the answer to help future readers.
I guess you could also avoid having to mess with those backslashes and escaped quotes, by doing:
| rex "number_of_goods[^:]+:(?<numberOfGoods>\d+),[^\w]+number_of_locations[^:]+:(?<numberOfLocations>\d+)"