Getting first match field in a event

[apand84]

In a service log different API being invoked each API start with ~( like ~getenrolled, ~enroll, ~submit) so is there any way to extract first API being called by rex

i tried (~\w+){1} but it matching with all called API .

[woodcock]

Like this:

... | rex "~(?<FirstAPIName>\w+)"

[apand84]

Unfortunately it will match all called api (started with ~+API name )
I wanted to extract first matched api which is the main api call subsequent are sub api in service log .

[woodcock]

Then this:

 ... | rex max_match=1 "~(?<FirstAPIName>\w+)"

[niketn]

Based on the sample data provided please try the following rex command with max_match=1 (which is by default):

|  makeresults
|  eval _raw="~getenrolled, ~enroll, ~submit, ~somethingelse, ~somethingnew"
|  rex  "~(?<FirstAPIName>[^,]+)," max_match=1

Alternatively, you can also use caret sign ( ^ ) if you want to extract required API Name only from beginning of raw data (depends on the data, if this does not work please provide sample raw data)

|  makeresults
|  eval _raw="~getenrolled, ~enroll, ~submit, ~somethingelse, ~somethingnew"
|  rex  "^~(?<FirstAPIName>[^,]+),"

PS: First two pipes with makeresults and eval are used to generate mock data for testing regular expression.