I have the following text line:
COLC  |BCCR7520|ACAUTLO1|     300|2017-01-03-12.00.12.000000|2017-01-03-12.02.30.000000|  159|  159|    0| 2M18| 0:01.03| 2M18|    0|    4|LOAD AUTH MASTER TBL|2017-01-03-12.00.12.000000|
I have tried this with no avail:
| rex field=.* "(?<f01>[^\|].*)\|(?<f02>.*)\|" |table f01, f02
Appreciate the help.
try using this -
| rex field=_raw "^(?[^|].+)|(?[^|].+)|" | table f01, f02
try using this -
| rex field=_raw "^(?[^|].+)|(?[^|].+)|" | table f01, f02
That did it!
Thank you for your help.
Thank you for the input. But I seem to have no luck with it. I still get blanks in the result set.
Will the field=.* return all the data to the end of the line so the rest of the rule can break it down?
I see data in the "events" (299,102 rows). One row from the events:
RENC  |OROB531K|        |       0|2017-01-05-02.05.47.000000|2017-01-05-02.05.54.000000|17761|17761|    0|    7| 0:00.46|24H00|24H00|    1|LROP D/B RESTORE    |2017-01-04-02.04.57.000000|                 |0001-01-01|        |       0|  |       -|       -|       -|
