Create new fields based on value of another fields.

[paragvidhi]

Hi All,
In my log, I have one field called ServerName. Below are some values of that field.

DAAPP2aBANG2
DFAPP20bLON2
UATSER1aUS1
UATSER1bUS2

We differentiate the above server with node A and node B based on the first character we got after the first occurrence of one or more digit.

DAAPP2aBANG2 -- its node a
DFAPP20bLON2 --- its node b
UATSER1aUS1 --- its node a
UATSER1bUS2 --- its node b

Here I want to create two fields called NodeA, and NodeB

In NodeA it should contain DAAPP2aBANG2 ,UATSER1aUS1
In NodeB it should contain DFAPP20bLON2, UATSER1bUS2

[gcusello]

Hi @paragvidhi,
you could try something like this:

index=your_index
| rex field=ServerName "\w+\d(?<Node>a|b)"
| eval Node="Node ".Node
| table ServerName Node

You can test the regex at https://regex101.com/r/jLeU1f/1

Ciao.
Giuseppe