Extract field till nth repetition of a string

[gowtham495]

I have following sample event

jaskdjkasdkjas CR akjhdjhdjsdhCR 1231jljk23klj3 CR sagdiugsds 7126372 nklsdlkCR

i need to extract field upto 3rd CR

my output string should be like this : jaskdjkasdkjas CR akjhdjhdjsdhCR 1231jljk23klj3

Can this be done using rex command ?
any help is appreciated !

[nickhills]

I have deviated slightly from your question, but I am surprised you dont want the value of the text between the 2nd CR and the 3rd CR?

in that case, the following example should work:

|makeresults | eval msg="jaskdjkasdkjas CR akjhdjhdjsdhCR 1231jljk23klj3 CR sagdiugsds 7126372 CR nklsdlkCR"| rex field=msg "((?P<output>.*?)\sCR\s){3}"

If you only wanted the 1st, or 2nd CR change the number in brackets

[gowtham495]

@nickhillscpl thanks for the query.
but it does not showing the desired output.
btw,i need the text between 2nd and 3rd CR too.

[vnravikumar · Accepted solution]

Hi @gowtham495

Try this

|makeresults | eval msg="jaskdjkasdkjas CR akjhdjhdjsdhCR 1231jljk23klj3 CR sagdiugsds 7126372 nklsdlkCR"| rex field=msg "(?P<output>.*)\sCR\s"

[gowtham495]

thanks for the reply .
can you please explain how this takes care of "3rd CR "

[vnravikumar]

Hi @gowtham495

Try this
[Updated]

| makeresults 
 | eval msg="jaskdjkasdkjas CR akjhdjhdjsdhCR 1231jljk23klj3 CR sagdiugsds 7126372 CR nklsdlkCR" 
 | rex field=msg "(?<output>^((.*?)(CR)){3})" 
 | eval output=replace(output,"(\s*CR)$","")

[vnravikumar]

let me know any issues.

[gowtham495]

this one worked.. thanks !!!

[vnravikumar]

welcome 🙂