Extract one word

[edfigue]

Hello, 

How can I extract debitsksvrvru7 from this query:

sndb(1p_debitsksvrvru/-363877568/localhost_debitsksvrvru7)pass:len=152

field name= Description

thank you

[rnowitzki · Accepted solution]

Hi @edfigue,

If the string looks similiar all the time, you could do it on searchtime with rex:

| rex field=Description "\/localhost\_(?<new_field>\S*)\)"

If it is not everytime "localhost_" in front of the data you need you would have to change it to something more generic.

Hope it gives you an idea.
BR
Ralph

--
Karma and/or Solution tagging appreciated.

[edfigue]

Thank you, that works!! 🙂