I'm trying to concatenate something onto one of my regex's.
index=eph | rex "EPH(?P<EPHID>\d+)" | table EPHID, _raw
I want the EPHID regex to be EPH902834091 instead of just 902834091. So even though the regex is "EPH(?P\d+)", I want the "EPH" at the beginning included. Is there a way to do this?
Why not just include it in the group?
View solution in original post
Just include the EPH in the matching group.
index=eph | rex "(?<EPHID>EPH\d+)" | table EPHID, _raw