I'm trying to exclude the word query and in from my string to create a new field called query. I'm not having any luck excluding the two outliers.
| rex "(?P<"Query">(query)\b.*\b(in\s))"
Example String: Query id,caption,alttext,height,width,urlimage,tracking_name,tracking_link_name,tracking_section in.
Output desired: id,caption,alttext,height,width,urlimage,tracking_name,tracking_link_name,tracking_section
Hi ashnet16,
try this:
| rex "[qQ]uery\s(?P<Query>.*)\sin"
cheers, MuS
Hi ashnet16,
try this:
| rex "[qQ]uery\s(?P<Query>.*)\sin"
cheers, MuS
Works perfectly! Thanks!