Help in Regex

[vrmandadi]

I have the field message - Method: Execute | Class: GetUsersByVinActivity
message- Method: Execute | Class: DecodeVinActivity

I want the method and class to extract as new fields from the message field

Thanks in advance

[MuS · Accepted solution]

Hi vrmandadi,

if the events are always in the format of the example you can use this regex:

 your search here to get the events 
| rex max_match=0 field=message "Method:\s(?<Method>[^\s]+)\s\|\sClass:\s(?<Class>[^\s]+)" 
| table _time Method Class

Hope this helps ...

cheers, MuS

[vrmandadi]

Thanks a lot Mus

[jrbanks6]

^\w+\s+.\s+\w+.\s+\w+\s+\w+.\s+\w+.\s+(?\w+\s+).\s+\w+.\s+(?\w+)

This is a "Greedy" RegEx - Regex101.com is your friend!