I have data
2018-07-23 21:00:54##7049015762##358479078622895##2##4000######N##ABS##|##USER_NUMBER##QUERY##1##90864
I want exact user=7049015762; number=90864,
I can use mvindex:
| eval user=mvindex(split(_raw,"##"),1)| eval number=mvindex(split(_raw,"##"),-1)
But I prefer rex if possible, thanks! (is rex more effective than mvindex?)
@jianyu75074, try the following rex command
<yourBaseSearch>
| rex "^[^\#]+\#\#(?<user>[^\#]+)+\#\#.*\#\#(?<number>\d+)$"
Following is a run anywhere search based on the sample data provided:
| makeresults
| eval _raw="2018-07-23 21:00:54##7049015762##358479078622895##2##4000######N##ABS##|##USER_NUMBER##QUERY##1##90864"
| rex "^[^\#]+\#\#(?<user>[^\#]+)+\#\#.*\#\#(?<number>\d+)$"
@jianyu75074, try the following rex command
<yourBaseSearch>
| rex "^[^\#]+\#\#(?<user>[^\#]+)+\#\#.*\#\#(?<number>\d+)$"
Following is a run anywhere search based on the sample data provided:
| makeresults
| eval _raw="2018-07-23 21:00:54##7049015762##358479078622895##2##4000######N##ABS##|##USER_NUMBER##QUERY##1##90864"
| rex "^[^\#]+\#\#(?<user>[^\#]+)+\#\#.*\#\#(?<number>\d+)$"