HI,
I am triying to use value from the below log in drop down and then filter based on this value in panel.
how can i extract this , please guide
Drop Down:
Field_ID
umt_nic_rbg_config.json
mrd.json
rbg_config.json
nic_rbg_config.json
/apps/dat/smrdau/xyz/mrd/temp/umt_nic_rbg_config.json_bu1595098800
/apps/dat/amrdau/xyz/mrd/temp/mrd.json_date=202
/apps/dat/amrdu/xyz/mrdap-ingestion/temp/rbg_config.json_business
/apps/dat/amrdau/xyz/mrdap/temp/nic_rbg_config.json_bdate=2020
@vikashperiwal try the following Reg Ex based approach with a run anywhere example that you can change with your SPL. Essentially just try the following regex | rex field="Field_ID" ("?<Field_ID>[^|\/]+.json"). If the regex does not work you may have to further test and modify regex as per your actual data as the following regex is based only on the sample data provided in the question.
| makeresults
| fields - _time
| eval Field_ID="umt_nic_rbg_config.json;mrd.json;rbg_config.json;nic_rbg_config.json;/apps/dat/smrdau/xyz/mrd/temp/umt_nic_rbg_config.json_bu1595098800;/apps/dat/amrdau/xyz/mrd/temp/mrd.json_date=202;/apps/dat/amrdu/xyz/mrdap-ingestion/temp/rbg_config.json_business;/apps/dat/amrdau/xyz/mrdap/temp/nic_rbg_config.json_bdate=2020"
| makemv Field_ID delim=";"
| mvexpand Field_ID
| rex field="Field_ID" ("?<Field_ID>[^|\/]+.json")
@vikashperiwal try the following Reg Ex based approach with a run anywhere example that you can change with your SPL. Essentially just try the following regex | rex field="Field_ID" ("?<Field_ID>[^|\/]+.json"). If the regex does not work you may have to further test and modify regex as per your actual data as the following regex is based only on the sample data provided in the question.
| makeresults
| fields - _time
| eval Field_ID="umt_nic_rbg_config.json;mrd.json;rbg_config.json;nic_rbg_config.json;/apps/dat/smrdau/xyz/mrd/temp/umt_nic_rbg_config.json_bu1595098800;/apps/dat/amrdau/xyz/mrd/temp/mrd.json_date=202;/apps/dat/amrdu/xyz/mrdap-ingestion/temp/rbg_config.json_business;/apps/dat/amrdau/xyz/mrdap/temp/nic_rbg_config.json_bdate=2020"
| makemv Field_ID delim=";"
| mvexpand Field_ID
| rex field="Field_ID" ("?<Field_ID>[^|\/]+.json")
This is exactly what i was looking for..... Thank you very much .. @niketn