I have the following address, and I want to extract the substring.
Address: 121, riverstreet, sydney, Australia.
I want to extract 'sydney'.
Help would be highly appreciated.
Assuming you already have the Address in a field called Address
| eval city=mvindex(split(Address,","),3) or | rex field=Address "([^,]+,){2}(?<city>[^,]+)"
Otherwise, use
| rex "Address:\s([^,]+,){2}(?<city>[^,]+)"