I hope everyone is having a great time today,
I am here to first thank you guys for being so helpful and assertive! you people rock! and second to ask for assistance regarding a regular expression.
I have a field that will contain a string that will start by "check-in unavailable due to external cause the ref code is ##AIUI- 989 K-IOJ##"
I want to be able to extract the string that is between the "##" but... sometimes this field may have a string that starts by "the auth was..." I want to be able to extract any string between two "#" whenever the value of the field starts with "check-in unavailable due to external cause the ref code is"
for example
if I have this:
FIELD | CODE |
"check-in unavailable due to external cause the ref code is ##AIUI- 989 K-IOJ## | AIUI- 989 K-IOJ |
"the auth was denied code ## uik-55855##" | N.A |
thank you guys SO MUCH
Kindy,
Cindy
| makeresults
| eval _raw="check-in unavailable due to external cause the ref code is ##AIUI- 989 K-IOJ##
the auth was denied code ## uik-55855##"
| multikv noheader=t
| fields _raw
| rex "check-in unavailable due to external cause the ref code is ##(?<code>[^#]+)##"
| makeresults
| eval _raw="check-in unavailable due to external cause the ref code is ##AIUI- 989 K-IOJ##
the auth was denied code ## uik-55855##"
| multikv noheader=t
| fields _raw
| rex "check-in unavailable due to external cause the ref code is ##(?<code>[^#]+)##"
I have a question what would the rex function will look like if instead of two "#" the coude would come inside two "*" like this : **UID J- DIDD**, I would just change the "#" by "*"??
Asterisks "*" have special meaning in regex so each would need to be escaped with a backslash "\"
| makeresults
| eval _raw="check-in unavailable due to external cause the ref code is **AIUI- 989 K-IOJ**
the auth was denied code ** uik-55855**"
| multikv noheader=t
| fields _raw
| rex "check-in unavailable due to external cause the ref code is \*\*(?<code>[^\*]+)\*\*"
@ITWhisperer I am in love with you
Thanks Cindy ❤️😁