How can I extract debitsksvrvru7 from this query:
field name= Description
Hi @edfigue,If the string looks similiar all the time, you could do it on searchtime with rex:
| rex field=Description "\/localhost\_(?<new_field>\S*)\)"
If it is not everytime "localhost_" in front of the data you need you would have to change it to something more generic.Hope it gives you an idea.BRRalph--Karma and/or Solution tagging appreciated.
View solution in original post
Thank you, that works!! 🙂