Hi,
I am using the following rex command to extract all text in between "....device-group:" and "succeeded ...." for a field called "old" and assigning the extracting values to a new field called "new".
| rex field=old "device-group:\s*(?<new>\S+)"
Currently, it is extracting all text in between "....device-group:" and "succeeded ...." EXCEPT for cases where there are multiple words with spaces.
Examples include:
1) "Panorama push to device:013101009509 for device-group: Austin Cloud DMZ succeeded. JobId=2484595" where the extracted values should be "Austin Cloud DMZ "
2) "Panorama push to device:013101014290 for device-group: Austin Bank Segmentation succeeded. JobId=2482583" where the extracted values should be "Austin Bank Segmentation"
Can you please help on extracting such cases too?
Thank you!
Solved it myself actually: | rex field=body "device-group:\s*(?<deviceGroup>.+?) succeeded"
Solved it myself actually: | rex field=body "device-group:\s*(?<deviceGroup>.+?) succeeded"