New column using regex

[yifatcy]

Hi,

I have the field Queue in my dataset with pattern as follows:

adcams01

adcams02

adcems05

I would like to create a new column in my table which contains 3 letters after adc. For example:

Queue:	Site
adcams01	ams
adcams02	ams
adcems05	ems

Is it possible using regex? I know it should include eval but it didn't work for me.

Thank you

[ITWhisperer]

| rex field=Queue "adc(?<Site>[^\d]+)"

[kamlesh_vaghela · Accepted solution]

@yifatcy 

Try

YOUR_SEARCH
 | rex field=Queue "adc(?<Site>.{3})"

Sample Search:

| makeresults | eval _raw="Queue
adcams01
adcams02
adcems05" | multikv forceheader=1 | table Queue | rex field=Queue "adc(?<Site>.{3})"

Thanks
Kamlesh Vaghela 

If this reply helps you, an upvote would be appreciated.

[yifatcy]

Works! thanks