Is it possible to use regex to extract values in events that always end with .PDF ? I have got a chain of events, somewhere in this process a PDF doucment is generated, So the name of the PDF is not in all the events.
Based on the example you provided in the question comments, this should return the data you are looking for:
| rex "(?<PDFFileName>\S+)\.[Pp][Dd][Ff]"
Here's the regex101 link showing it function on your example: https://regex101.com/r/OyLl8z/1
Sounds like you're saying that you're looking for all events related to one that eventually generates a PDF? If so then is there a unique identifier that ties them all together? I'm asking because you could use a subsearch to gather all unique identifiers from those "PDF" events, and then use those identifiers later in your search to find relates events.
Posting a sample list of events will help.
YOu should be able to use following regex (assuming that youru PDF file name contains alphanueric characters only)
your base search | rex "(?<PDFFileName>[A-z0-9_]+\.(pdf|PDF))"
Again, for better solution, please provide sample data and highlight the portion you want to extract.
Thanks, almost what I need, due to the lack of me supplying an example not quite everything I need.
this is a fragment of the events:
: Get file ABC_6_2019-09-30_VK-161.2285507.pdf from /opt/mulesoft/
I would like to extract the values: ABC_6_2019-09-30_VK-161.2285507.pdf
It always ends with .PDF but the first part can differ, in my example it starts with ABC but this can also be ZZ for example
Please share some sample data and what you want extracted from it.
this is a fragment of the events:
: Get file ABC_6_2019-09-30_VK-161.2285507.pdf from /opt/mulesoft/
I would like to extract the values: ABC_6_2019-09-30_VK-161.2285507.pdf
It always ends with .PDF but the first part can differ, in my example it starts with ABC but this can also be ZZ for example