I want to extract the value of Output Quality from the below log.
Critical-Lab checkRcReady for batchId ==>9a508f01-4e93-4d76-9a9d-fe1cf8bd0550==true :: Output Quality 0.0%"
Output Quality is 0.0%. I want to extract this value. How do you do it with regex?
Update- included the max_match -
| makeresults | eval logs = "batchId ==>ceba8481-7806-4b03-a8c9-811bdc340a05==true :: Output Quality 7.2%
batchId ==>04b0800f-74e2-4522-bfd0-9621af9d4536==true :: Output Quality 9.5%
batchId ==>d66872a1-4cf7-433c-a86d-d7ac097537d8==true :: Output Quality 34.28%
batchId ==>3d4606ec-f607-4187-9f58-47d88f99ac0a==true :: Output Quality 90.34%"
| rex field=logs max_match=0 "Output Quality (?P<Quality>\d+\.\d+\%)" | table Quality logs
Update- included the max_match -
| makeresults | eval logs = "batchId ==>ceba8481-7806-4b03-a8c9-811bdc340a05==true :: Output Quality 7.2%
batchId ==>04b0800f-74e2-4522-bfd0-9621af9d4536==true :: Output Quality 9.5%
batchId ==>d66872a1-4cf7-433c-a86d-d7ac097537d8==true :: Output Quality 34.28%
batchId ==>3d4606ec-f607-4187-9f58-47d88f99ac0a==true :: Output Quality 90.34%"
| rex field=logs max_match=0 "Output Quality (?P<Quality>\d+\.\d+\%)" | table Quality logs
I just don't have 4 lines, but there are multiple lines. How to write one REGEX.
I tried below REGEX, but could not got the desired result.
index="cpsprod" sourcetype="mscs:storage:blob:cps-qa-rc-calc" "batchId ==>""==true :: Output Quality" | rex field=logs max_match=0 "Output Quality (?P\d+.\d+\%)" | table Quality
rex field=logs
max_match=0
You should use the field which contains the logs.. or "_raw"
rex field=_raw max_match=0