I want to extract the previous line if found a matching string in an event.
for Eg in an event :
4XESTACKTRACE at com/mypackage/test/TestClass1.method1(TestClass1.java:558(Compiled Code))
4XESTACKTRACE at com/mypackage/test/TestClass1.method2(TestClass1.java:148(Compiled Code))
4XESTACKTRACE at com/mypackage/test/TestClass1.run(TestClass1.java:55(Compiled Code))
I want to get the package or line (com/mypackage/test/TestClass1.method2) before the line containing run method.
rex max_match=10 field=_raw "at (?P
Thanks
Jagadish
You could try something like to only get stuff from the line directly above a line that contains ".run"
rex "at (?<aaa>[^(]+)[^\r\n]+[\r\n]+[^\r\n]+\.run" | table aaa
/K
You could try something like to only get stuff from the line directly above a line that contains ".run"
rex "at (?<aaa>[^(]+)[^\r\n]+[\r\n]+[^\r\n]+\.run" | table aaa
/K