My VLAN value looks like below:
|inputlookup vrf_usage.csv | search VRF="*" | search VLAN=Vlan819(RVP_CDN)
Could you please help me getting VLAN value as Vlan819 just before ( symbol. That is just before the bracket starts.
Come back and click Accept on the best answer, @surekhasplunk!
There are many ways. Here is another one:
... | rex field=VLAN mode=sed "s/\(.*$//"
| eval VLAN="vlan(foo)"
| rex field=VLAN mode=sed "s/\(.*$//"
| eval VLAN ="Vlan819(RVP_CDN)"
| eval result = mvindex(split(VLAN,"("),0)
it could be useful to share a sample of your logs.
Anyway, you could use something like this
| rex "Vlan819<VLAN>\w+)"
to test with a sample.
|rex field=VLAN "(?<VLAN>.+)\("
Looks great -
| eval VLAN="Vlan819(RVP_CDN)"
| rex field=VLAN "(?<VLAN>.+)\("