I have following sample event
jaskdjkasdkjas CR akjhdjhdjsdhCR 1231jljk23klj3 CR sagdiugsds 7126372 nklsdlkCR
i need to extract field upto 3rd CR
my output string should be like this : jaskdjkasdkjas CR akjhdjhdjsdhCR 1231jljk23klj3
Can this be done using rex
command ?
any help is appreciated !
Hi @gowtham495
Try this
|makeresults | eval msg="jaskdjkasdkjas CR akjhdjhdjsdhCR 1231jljk23klj3 CR sagdiugsds 7126372 nklsdlkCR"| rex field=msg "(?P<output>.*)\sCR\s"
I have deviated slightly from your question, but I am surprised you dont want the value of the text between the 2nd CR and the 3rd CR?
in that case, the following example should work:
|makeresults | eval msg="jaskdjkasdkjas CR akjhdjhdjsdhCR 1231jljk23klj3 CR sagdiugsds 7126372 CR nklsdlkCR"| rex field=msg "((?P<output>.*?)\sCR\s){3}"
If you only wanted the 1st, or 2nd CR change the number in brackets
@nickhillscpl thanks for the query.
but it does not showing the desired output.
btw,i need the text between 2nd and 3rd CR
too.
Hi @gowtham495
Try this
|makeresults | eval msg="jaskdjkasdkjas CR akjhdjhdjsdhCR 1231jljk23klj3 CR sagdiugsds 7126372 nklsdlkCR"| rex field=msg "(?P<output>.*)\sCR\s"
thanks for the reply .
can you please explain how this takes care of "3rd CR "
Hi @gowtham495
Try this
[Updated]
| makeresults
| eval msg="jaskdjkasdkjas CR akjhdjhdjsdhCR 1231jljk23klj3 CR sagdiugsds 7126372 CR nklsdlkCR"
| rex field=msg "(?<output>^((.*?)(CR)){3})"
| eval output=replace(output,"(\s*CR)$","")
let me know any issues.
this one worked.. thanks !!!
welcome 🙂