use partial data from a field in reports

New Member


We have a version field with 4 numbers, for instance 2018.1.0.1234 (

One report will need the full version number, but we also want a chart which essentially throws away (leaving just values such as 2018.0, 2018.1, etc.). Of course we could send the data with a second key to get the shorter values, but I assume there are better ways so we can keep our data throughput down.

Would appreciate help with example(s) of how to achieve this.


0 Karma

Re: use partial data from a field in reports


hello there,

many ways to go about this one, here is a sample using the | rex command to create 4 fields as you asked above.
run this search anywhere to check:

    | makeresults count=1 
    | eval version="2018.1.0.1234,2018.2.0.1234,2018.1.2.1234,2018.1.0.1235"
    | makemv delim="," version
    | mvexpand version
    | rex field=version "(?<major>\d+)\.(?<minor>\d+)\.(?<patch>\d+)\.(?<build>\d+)"

from here you can go many ways, for example"
| eval major_minor = major.".".minor

hope it helps

View solution in original post