Extra data

[btheneghan]

I have never been one to understand regex, however I need to extract everything after the first entry (#172...) into it's own field.  Let's call it manual_entry.  I'm getting tired of searching and randomly trying things.

#1724872356 exit
#1724872357 exit
#1724872463 cat .bashrc
#1724872485 sudo cat /etc/profile.d/join-timestamp-history.sh
#1724872512 exit
#1724877740 firefox

manual_entry

exit
exit
cat .bashrc
sudo cat /etc/profile.d/join-timestamp-history.sh
exit
firefox

[gcusello]

Hi @btheneghan ,

if you already extracted the field manual_entry and the format is always the one you descripted in your samples, you could use this regex:

| rex field=manual_entry "^\#\d+\s(?<manual_entry>.*)"

if you didn't extracted the field manual_entry and the format is always the one you descripted in your samples, you could use:

| rex "^\#\d+\s(?<manual_entry>.*)"

 Ciao.

Giuseppe

[richgalloway]

There's probably more than one way to do that.  If you want to use rex then this should do it.  It just takes everything after the first space as the manual_entry field.

| rex "\s(?<manual_entry>.*)"