How to create a regex that removes everything after a second underscore?

[gbwilson]

I have a regex that should remove everything after a second underscore. When I try to search with the regex, it doesn't work. Any ideas? I must be doing something wrong, just can't figure out what.

Data looks like this:

AB200_Cdef_233
Abcde_FG400_34
And should end up looking like this:

AB200_Cdef
Abcde_FG400

    index=cms_vm
    | eval DatastoreName=replace(DatastoreName,"^[^_]*_[^_]*\K.*$")
    | table DatastoreName
    | dedup DatastoreName
    | sort DatastoreName

[FrankVl · Accepted solution]

Your regex is fine, you're just missing the mandatory 3rd argument of the replace(X,Y,Z) function.

It should work fine if you run it like this:

 index=cms_vm
 | eval DatastoreName=replace(DatastoreName,"^[^_]*_[^_]*\K.*$","")
 | table DatastoreName
 | dedup DatastoreName
 | sort DatastoreName

[ddrillic]

Maybe -

index=cms_vm
 | rex field=DatastoreName "(?<DatastoreName>.*_.*)_.*"
 | table DatastoreName
 | dedup DatastoreName
 | sort DatastoreName

[rteja9]

Try below query,

index=cms_vm
| eval DatastoreName=replace(DatastoreName,"^[^]+[^_]+(.*)","")
| table DatastoreName
| dedup DatastoreName
| sort DatastoreName