Hi Everyone,
I am still new to Splunk and have found myself in a predicament for extracting a specific value, within a value. So for the following:
usb#android(04e8) mass storage(685e)#abc123abc123
I am trying to extract everything between # and # so essentially "android(04e8) mass storage(685e)". I have head about using regex/rex but I wasn't sure if there was an eval function that could perform this?
Why not use regex? 🙂
rex "#(?<yourfieldname>.+?)#"
Perfect. Was also looking at I would pull all the content from the beginning to a specific character ")". Ex from above: "android"
Also, any recommended avenues for learning this version of regex (books, articles, etc)