On using regex one by one to replace two types of strings its is giving the following error. Also while using the replace twice it is giving the error
Error in 'rex' command: Regex: quantifier does not follow a repeatable item
Any way to work around this.
My query looks like the following
index=abc sourcetype=def "pushed to the connector." | rex field=message "Message to \'(?<push>.*)\' pushed to the connector." | rex field=push mode=sed "s/ //g" | rex field=push mode=sed "s/+//g" | table message push
And for replace it is
index=abc sourcetype=def "pushed to the connector." | rex field=message "Message to \'(?<push>.*)\' pushed to the connector." | eval final=trim(replace(push," ","")) | eval final2=replace(final,"+","") | table message push final final2
How to work around this issue.
@AshimaE, you need to escape plus sign in second replace with slash. Please refer to the modifications below
index=abc sourcetype=def "pushed to the connector."
| rex field=message "Message to \'(?<push>[^'].*)\' pushed to the connector."
| eval final=replace(replace(push," ",""),"\+","")
| table message push final
[^']
which says find everything (refer to regex101.com for details)
except single quote which currently marks the end of extracted field pushed.@AshimaE, can you please test and confirm whether the suggested change worked for you?