Add this to your existing search:
... | rex field=YourExistingFieldName "^(?<YourNewFieldName>[^#]+)"
Add this to your existing search:
... | rex field=YourExistingFieldName "^(?<YourNewFieldName>[^#]+)"
Hi woodcock,
I want it should get split only alphabets followed by a #, if a space is followed by a #. then i don't want to. can you please help me to do it
Like this:
... | rex field=YourExistingFieldName "^(?