How can I Rex to match until a string

[mattodo]

Hi folks,

I'm new to regex and am struggling to extract a number from a field. I basically need the amount extracted from the following;

Date Name Amount Curr Type Status
------------------- -------------------- ---------- ---- ------------ ------
07.05.2016 22:58:09 Person's Name 5.00 GBP Sale Okay

It is the variable length text before the number that I am struggling with.

Please can you suggest a way in which I can extract just the 5.00 in the above example?

Thanks in advance 🙂

Matt

[javiergn · Accepted solution]

Try this but ignoring the top 3 lines that I used to replicate your event.

Option 1 (from your raw event):

| stats count
| fields - count
| eval _raw = "07.05.2016 22:58:09 Person's Name 5.00 GBP Sale Okay"
| rex field=_raw "(?<Amount_num>\d+\.\d{2}) GBP"

Option 2 (assuming there's a field named Amount as indicated above):

| stats count
| fields - count
| eval Amount = "5.00 GBP"
| rex field=Amount "(?<Amount_num>\d+\.\d{2})"

[mattodo]

Many thanks for the prompt reply Javiergn, It shows I am new to this because I copied and pasted from one of my records and the formatting was lost. There are actually many spaces between the field sections. I have now found the code sample feature 😉 so the data should look like this;

Date                Name                     Amount Curr Type         Status
------------------- -------------------- ---------- ---- ------------ ------
07.05.2016 22:58:09 Person's name                 5.00 GBP  Sale         Okay  

The rex you gave did not return anything. Is this due to the extra spaces?

Thanks again!

Matt

[mattodo]

Hi again, your method worked great (minor error on my part) so I have exactly what I need.

Many thanks, you have really helped me out!

[javiergn]

Hi, no worries. Happy to help.

If you are happy with the response please mark it as answered so that others can benefit from it.

[mattodo]

done 🙂 TY