How to create a regex for extracting few characters of a field?

[surekhasplunk]

My VLAN value looks like below:

|inputlookup vrf_usage.csv | search VRF="*" | search VLAN=Vlan819(RVP_CDN) 

Could you please help me getting VLAN value as Vlan819 just before ( symbol. That is just before the bracket starts.

[woodcock]

Come back and click Accept on the best answer, @surekhasplunk!

[woodcock]

There are many ways. Here is another one:

... | rex field=VLAN mode=sed "s/\(.*$//"

For example:

| makeresults 
| eval VLAN="vlan(foo)" 
| rex field=VLAN mode=sed "s/\(.*$//"

[vnravikumar]

Hi

Try this,

| makeresults 
| eval VLAN ="Vlan819(RVP_CDN)" 
| eval result = mvindex(split(VLAN,"("),0)

[gcusello]

Hi surekhasplunk,
it could be useful to share a sample of your logs.
Anyway, you could use something like this

| rex "Vlan819<VLAN>\w+)"

to test with a sample.

Bye.
Giuseppe

[renjith_nair]

@surekhasplunk ,

Try

|rex field=VLAN "(?<VLAN>.+)\("

[ddrillic]

Looks great -

| makeresults 
| eval VLAN="Vlan819(RVP_CDN)" 
| rex field=VLAN "(?<VLAN>.+)\("