Hello everyone,
I have multiple fields and i want to extract an ID from it. (That's the only value that changes in it)
My fields are : class, method, message, nb.
Message field is like this : "] id not found for opp : [12345azeAZE"
I wanted to extract the value after the "[" (in bold) and create a message with it.
Can i have a result like this please :
There are $nb$ errors from the method: $method$ with the class: $class$ on the opp: $message$.
Thanks.
I found the solution with your help @vnravikumar
| rex field=my_message ":\s\[(?P<result>[^\"]+)"
| stats count as nb by result
| fields nb, result
| multikv forceheader=1
| strcat "- ", nb, " error(s) with the opportunity ",result message
| fields message
| mvcombine message delim="
"
| nomv message
I found the solution with your help @vnravikumar
| rex field=my_message ":\s\[(?P<result>[^\"]+)"
| stats count as nb by result
| fields nb, result
| multikv forceheader=1
| strcat "- ", nb, " error(s) with the opportunity ",result message
| fields message
| mvcombine message delim="
"
| nomv message
Thanks for your answer @vnravikumar
It works for the extraction but, i forgot to say that this ID change a lot and with your solution, i only extract one of them.
i have a list of them :
"] id not found for opp : [12345azeAZE" (A)
"] id not found for opp : [12345azeAZE" (A)
"] id not found for opp : [12345azeAZE" (A)
"] id not found for opp : [75895kezWXE" (B)
"] id not found for opp : [75895kezWXE" (B)
"] id not found for opp : [35856uioAME" (C)
"] id not found for opp : [35856uioAME" (C)
And i want to extract the ID with the number of time that appears
Ex: (the method and the class doesn't change)
There are $nb$ errors from the method: $method$ with the class: $class$ on the opp: $message$.
There are 3 errors from the method: $method$ with the class: $class$ on the opp: (A)
There are 2 errors from the method: $method$ with the class: $class$ on the opp: (B)
There are 2 errors from the method: $method$ with the class: $class$ on the opp: (C)
Thanks.
Hi
Try this
| makeresults
| eval message="\"] id not found for opp : [12345azeAZE\" (A),
\"] id not found for opp : [12345azeAZE\" (A),
\"] id not found for opp : [12345azeAZE\" (A),
\"] id not found for opp : [75895kezWXE\" (B),
\"] id not found for opp : [75895kezWXE\" (B),
\"] id not found for opp : [35856uioAME\" (C),
\"] id not found for opp : [35856uioAME\" (C)"
| makemv delim="," message
| mvexpand message
| rex field=message ":\s\[(?P<test>[^\"]+)"
| stats count by test
I can't do this because, i didn't know the ID (the part after "opp:") by advance and i had a lot of results.
] id not found for opp : [12345azeAZE
I need to summarize the results with the ID extracted and the number of time it appears.
Hi
Try this rex
| makeresults
| eval message=" \"] id not found for opp : [12345azeAZE\""
| rex field=message ":\s\[(?P<test>[^\"]+)"