rex to extract the key value

[vikashperiwal]

HI,

I am triying to use value from the below log in drop down and then filter based on this  value in panel. 

how can i extract this , please guide

Drop Down:

Field_ID

umt_nic_rbg_config.json

mrd.json

rbg_config.json

nic_rbg_config.json

/apps/dat/smrdau/xyz/mrd/temp/umt_nic_rbg_config.json_bu1595098800

/apps/dat/amrdau/xyz/mrd/temp/mrd.json_date=202

/apps/dat/amrdu/xyz/mrdap-ingestion/temp/rbg_config.json_business

/apps/dat/amrdau/xyz/mrdap/temp/nic_rbg_config.json_bdate=2020

[niketn · Accepted solution]

@vikashperiwal try the following Reg Ex based approach with a run anywhere example that you can change with your SPL. Essentially just try the following regex | rex field="Field_ID" ("?<Field_ID>[^|\/]+.json"). If the regex does not work you may have to further test and modify regex as per your actual data as the following regex is based only on the sample data provided in the question.

| makeresults
| fields - _time
| eval Field_ID="umt_nic_rbg_config.json;mrd.json;rbg_config.json;nic_rbg_config.json;/apps/dat/smrdau/xyz/mrd/temp/umt_nic_rbg_config.json_bu1595098800;/apps/dat/amrdau/xyz/mrd/temp/mrd.json_date=202;/apps/dat/amrdu/xyz/mrdap-ingestion/temp/rbg_config.json_business;/apps/dat/amrdau/xyz/mrdap/temp/nic_rbg_config.json_bdate=2020"
| makemv Field_ID delim=";"
| mvexpand Field_ID
| rex field="Field_ID" ("?<Field_ID>[^|\/]+.json")

[vikashperiwal]

This is exactly what i was looking for..... Thank you very much .. @niketn