Hi,
We have a version field with 4 numbers, for instance 2018.1.0.1234 (major.minor.patch.build)
One report will need the full version number, but we also want a chart which essentially throws away patch.build (leaving just values such as 2018.0, 2018.1, etc.). Of course we could send the data with a second key to get the shorter values, but I assume there are better ways so we can keep our data throughput down.
Would appreciate help with example(s) of how to achieve this.
Thanks!
hello there,
many ways to go about this one, here is a sample using the | rex
command to create 4 fields as you asked above.
run this search anywhere to check:
| makeresults count=1
| eval version="2018.1.0.1234,2018.2.0.1234,2018.1.2.1234,2018.1.0.1235"
| makemv delim="," version
| mvexpand version
| rex field=version "(?<major>\d+)\.(?<minor>\d+)\.(?<patch>\d+)\.(?<build>\d+)"
from here you can go many ways, for example"
| eval major_minor = major.".".minor
hope it helps
hello there,
many ways to go about this one, here is a sample using the | rex
command to create 4 fields as you asked above.
run this search anywhere to check:
| makeresults count=1
| eval version="2018.1.0.1234,2018.2.0.1234,2018.1.2.1234,2018.1.0.1235"
| makemv delim="," version
| mvexpand version
| rex field=version "(?<major>\d+)\.(?<minor>\d+)\.(?<patch>\d+)\.(?<build>\d+)"
from here you can go many ways, for example"
| eval major_minor = major.".".minor
hope it helps