I have a search result with following string i just need to extract the value - 0.000 (just before %) from this string below
"XYZ Inc","Air","0 Days + 01:00:00",1,"0.000 %"
I tried following
..| rex field=raw "(?
Close... you're missing a few details.
Here is your regex (the double quotes are escaped only when you use them in the search box, because the rex command wants the regex contained in double quotes... it isn't regex that requires them escaped, mind you)
your base search | rex field=_raw"^\"(?P<name>.+)\",\"(?P<Type>.+)\",\"(?P<tdtime>.+)\",(?P<number_of_out>\d+),\"(?P<avail>.+)%\""
This site is very helpful for testing:
You may want to just use the field extractor and avoid using the rex command altogether...
above regex works for me
nikhilmehra79, you should copy EXACTLY what somesoni2 has given you and try that. Do not change the regex. It is the same as the one I gave you exactly... and it works. The difference is - this version has kindly given you the entire search. I was lazy. 🙂
I have edited the answer accordingly - including the prefix eval so that the code is independent for those of us who do not have your data in an index.
the point is "XYZ Inc","Air","0 Days + 01:00:00",1,"0.000 %"
is just one example of event i have various other events with different text, in that case i dont think hard coding the values in seacrh will work?