I'm trying to concatenate something onto one of my regex's.
ie:
index=eph | rex "EPH(?P<EPHID>\d+)" | table EPHID, _raw
I want the EPHID regex to be EPH902834091 instead of just 902834091. So even though the regex is "EPH(?P
Thanks!!!
Just include the EPH in the matching group.
index=eph | rex "(?<EPHID>EPH\d+)" | table EPHID, _raw
Why not just include it in the group?
rex "(?<EPHID>EPH\d+)"