Filter Search results

[bansi]

The search result produces output of a column in following format

Element[contractId=true,memberId=<null>,name=[Name [value=true,nameType=NAME]],dateOfBirth=true

Wondering if it is possible to filter the output of these columns to have just the keys and not key=value pairs i.e. have output like

contractId,memberId,name,dateOfBirth

instead of

contractId=true,memberId=<null>,name=[Name[value=true,nameType=NAME]],dateOfBirth=true

[southeringtonp]

Take a look at the rex command. There are multiple ways you could do it, but here's one:

| rex field=yourfield max_match=50 "(?<key_list>[A-Za-z]+)="
| eval newfield=mvjoin(key_list,",")

You'll end up with the result in the new field key_list. Skip the second part if you want to keep it as a multi-valued field instead of merging them back into a single entry.

[southeringtonp]

You will need to write a regex that matches your format, or possibly use the xpatch commands. Take a look at the docs for reg and xpath. If you use rex, you may want to try out Kodos or RegexBuddy to help you troubleshoot your regular expression.

[bansi]

How to extract values between Elements tag.


contract2_100



true
true




001



true
true