Extract substring from field

[alesSantiago]

Hi,

I'm facing a problem with string extraction . The scenario is as follows: I'm passing an ID from one chart to another form through URL and, before populating it to the new charts, I need to "remove" some additional data from that string.

Let's say that I receive this kind of string ID: "idfromchart(reverse)" through the URL and I need just the "idfromchart" without the "(reverse)" part. First I need to format the id to the correct value, then I'll try to populate it actually...one step at a time 😉

Any help provided it would be really appreciated.
Thanks!

[jtrucks · Accepted solution]

Try replace. Maybe something like:

… | replace idfromchart* with idfromchart in yourfieldname

Or…

… | replace "*(reverse)" with "*" in yourfieldname

I'd go with the latter option first, actually.

[alesSantiago]

The second option happened to format the ID to what I wanted. Thanks.
Out of this question, would you be able to tell me if the tag supports queries? I'm thinking about how to populate the formatted id and populate it to the rest of the charts through a dropdown.
thanks again!

[somesoni2]

For your step1. Formatting of id (assuming the format of the URL parameter is same as your example, means it contains "(" symbol.

* |head 1| eval body="somestring(reverse)" | table body | eval body1=mvindex(split(body,"("),0) |rex field=body "(?<body2>[^(]+)"

you can use any one of body1 or body2 for your formatting.

[alesSantiago]

Thanks for your answer.
I did try this solution, but I wasn't able to make it work the way I wanted.
So the reason why I didn't mark it as a valid answer was not about that it might be or not correct (sure it is), it is about my lack of knowledge in regex. It might be useful for somebody else.
thanks 🙂