Hello,
How can I extract debitsksvrvru7 from this query:
sndb(1p_debitsksvrvru/-363877568/localhost_debitsksvrvru7)pass:len=152
field name= Description
thank you
Hi @edfigue,
If the string looks similiar all the time, you could do it on searchtime with rex:
| rex field=Description "\/localhost\_(?<new_field>\S*)\)"
If it is not everytime "localhost_" in front of the data you need you would have to change it to something more generic.
Hope it gives you an idea.
BR
Ralph
--
Karma and/or Solution tagging appreciated.
Hi @edfigue,
If the string looks similiar all the time, you could do it on searchtime with rex:
| rex field=Description "\/localhost\_(?<new_field>\S*)\)"
If it is not everytime "localhost_" in front of the data you need you would have to change it to something more generic.
Hope it gives you an idea.
BR
Ralph
--
Karma and/or Solution tagging appreciated.
Thank you, that works!! 🙂