Help with regex for field extraction

[mbasharat]

Hi,

I have a field value as below.
These are all fixed positions all across.

/COMPANY LOCATIONS/PA/PHILADELPHIA/ABC - PHILADELPHIA/

I need two regex:

1. Only State extracted from above new fields labeled as STATE
2. All fields extracted as LOCATION, STATE, CITY, CODE

Thanks in advance!!!

[woodcock]

Like this:

| makeresults 
| eval _raw="/COMPANY LOCATIONS/PA/PHILADELPHIA/ABC - PHILADELPHIA/" 
| rex "^\/(?<WHATEVER>[^\/]+)\/(?<LOCATION>[^\/]+)\/(?<STATE>[^\/]+)\/(?<CITY>[^\/]+)\/"

I am not sure what is supposed to be CODE ... ?

[mbasharat · Accepted solution]

After banging my head for a bit, I coded below run any where and it worked!!! 🙂

| gentimes start=-1 

| eval Location="/COMPANY LOCATIONS/PA/PHILADELPHIA/ABC - PHILADELPHIA/"

| table Location

| rex field=Location "^(?:[^\/\n]*\/){2}(?P<State>\w+)\/(?P<City>[^\/]+)\/(?P<Code>[^\/]+)"

[arjunpkishore5]

Could you please provide some more sample inputs and the expected output. For example, when you say you need LOCATION, STATE, CITY, CODE, what values should each of these hold with respect to your sample data?

[mbasharat]

Hi Arjun. See my own answer to my own question. Took some head bangs at this time of Friday! 🙂