I need to fetch the value 'app_mot_auto_toyota_cars_SOA' from the below string. I tried with the rex - rex field=_raw "[INFO ]\s[(?P<Applname>)]\s+". But it is not working.
Can anyone please help me with the regex expression.
> [INFO ] [app_mot_auto_toyota_cars_SOA]
This may help..
|makeresults | eval _raw="[INFO ] [app_mot_auto_toyota_cars_SOA]" | rex field=_raw "\[INFO\s]\s\[(?<Applname>\S+)]"
This may help..
|makeresults | eval _raw="[INFO ] [app_mot_auto_toyota_cars_SOA]" | rex field=_raw "\[INFO\s]\s\[(?<Applname>\S+)]"