regex to capture both fields as below

[pavanbmishra]

Hi SMEs,

Seeking help to capture below 2 strings (Only string1 & Only string1) as below in one regex

","category":"Only string1",

","category":"a1b2c3-Only string2",

[kamlesh_vaghela]

@pavanbmishra 

Can you please try this?

YOUR_SEARCH
 | rex field=_raw "\"category\":\"(.*\-)?(?<category>.*)\""

My Sample Search :

| makeresults | eval raw="\",\"category\":\"thisissomethingineedtocapture\",|\",\"category\":\"a1b2c3-thisissomethingialsoneedtocapture\",|\",\"category\":\"Only string1\",|\",\"category\":\"a1b2c3-Only string2\"," | eval raw=split(raw,"|")|mvexpand raw | rename raw as _raw
| rename comment as "Upto Now is sample data only" | rex field=_raw "\"category\":\"(.*\-)?(?<category>.*)\""

 Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

[pavanbmishra]

Let me be more clear here

","category":"thisissomethingineedtocapture",

","category":"a1b2c3-thisissomethingialsoneedtocapture",

Here thisissomethinginnedtocapture & thisissomethingialsoneedtocapture should come in regex value. These both are strings and doesn't have any numeric value.

[ITWhisperer · Accepted solution]

Often helps to be clearer 😀 Will this work?

| rex "\"category\":\".*?(?<string>[^\-\"]+)\""

[ITWhisperer]

| rex "\"category\":\".*(?<string>Only string\d)\""