How to fetch activity id using rex command
Log record:
DATA= {"note":"Succeeded | {\r\n \"service.url\": \"\",\r\n \"enable.debug\": false,\r\n \"permission.base.url\": \"\",\r\n \"userInfo.base.url\": \"\",\r\n \"storeId.base.url\": \"\",\r\n \"app.session.timeout\": 25\r\n},activityId: 64AB3318-4DA3-4D38-9800-5DABCC7EC263,","appVersion":"1.10"
I tried below query with no luck,
| rex field=DATA ",activityId: (?<ACTIVITY_ID_VALUE>.*)"
Trying to fetch value "64AB3318-4DA3-4D38-9800-5DABCC7EC263" and show in table
Hello @saifdj
please double check you that you have an extracted field DATA.
If not you can use a general regex applied to whole _raw event (which is not so effizient as you indended):
rex "activityId: (?<a1>[\w\-]+)"
Please let me know how if it worked
Slightly more generic (since it looks like a comma is the delimiter):
... | rex "activityId: (?<ACTIVITY_ID_VALUE>[^,]+)"