hai all,
need help on regex to extract Major as new field with message whatever after Major
Major SIPCM *SipCmRecvFromTcpSocket: Error in reading data on socketId 247, errno=104
Major NRS ARP lookup for 216.20.237.19 on interface pkt0 with addrContextId 1 failed: SIOGARP error , error 6
Major LVM *NpMediaYmacRespHdlr: error code 0x3 recvd for bcm cmd 4
Want to extract all message after Major and keep in a new fields as Major
Hi @sekhar463,
ok, all after Major in a field called "Major", please try this:
| rex "^Major\s+(?<Major>.*)"
that you can test at https://regex101.com/r/HBKc52/2
Ciao.
Giuseppe
Hi @sekhar463,
let me understand:
you want to extract the word after Major (SIPCM, NRS and LVM) in a field called "Major" and the string after these values to the end as "message" field, is it correct?
if this is your need, please try this regex:
| rex "^Major\s+(?<major>\w+)\s+(?<message>.*)"
that you can test at https://regex101.com/r/HBKc52/1
Ciao.
Giuseppe