Hi SMEs,
Seeking help to capture below 2 strings (Only string1 & Only string1) as below in one regex
","category":"Only string1",
","category":"a1b2c3-Only string2",
Often helps to be clearer 😀 Will this work?
| rex "\"category\":\".*?(?<string>[^\-\"]+)\""
Can you please try this?
YOUR_SEARCH
| rex field=_raw "\"category\":\"(.*\-)?(?<category>.*)\""
My Sample Search :
| makeresults | eval raw="\",\"category\":\"thisissomethingineedtocapture\",|\",\"category\":\"a1b2c3-thisissomethingialsoneedtocapture\",|\",\"category\":\"Only string1\",|\",\"category\":\"a1b2c3-Only string2\"," | eval raw=split(raw,"|")|mvexpand raw | rename raw as _raw
| rename comment as "Upto Now is sample data only" | rex field=_raw "\"category\":\"(.*\-)?(?<category>.*)\""
Thanks
KV
▄︻̷̿┻̿═━一
If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.
Let me be more clear here
","category":"thisissomethingineedtocapture",
","category":"a1b2c3-thisissomethingialsoneedtocapture",
Here thisissomethinginnedtocapture & thisissomethingialsoneedtocapture should come in regex value. These both are strings and doesn't have any numeric value.
Often helps to be clearer 😀 Will this work?
| rex "\"category\":\".*?(?<string>[^\-\"]+)\""
| rex "\"category\":\".*(?<string>Only string\d)\""