How to edit my regular expression to extract the numbers and semicolons from my sample data?

[ayusuf]

I don't understand how Splunk does regex!
I have this search below:

...
| spath output=test path=a.b.c
| rex field=test "?<test1>[0-9]+"
| table test, test1

Test is this: {"timehours":"16","timeminutes":"34","timeseconds":"11"}

How do I extract just the numbers and semicolon except the first semicolon?
Thanks!

[DalJeanis]

Here's another way. Still couldn't get it in just one rex.

This generates test results -

| makeresults | eval testfield="{\"timehours\":\"16\",\"timeminutes\":\"34\",\"timeseconds\":\"11\"}" 

This pulls out the time parts -

| rex field=testfield max_match=3 "(?<mytime>\d{1,2})" | eval mytime=mvjoin(mytime,":")

[sundareshr · Accepted solution]

Try this

 ...
 | spath output=test path=a.b.c
 | rex max_match=3 field=test "(?<t>\d{1,2})"
 | eval test1=mvindex(t, 0).":".mvindex(t, 1).":".mvindex(t, -1)
 | table test, test1

[ayusuf]

That works but is there a way to do it all in rex? Thanks.

[sundareshr]

With rex mode=sed you cannot assign the result to a different field. Try this

  ... | rex mode=sed field=test "s/{\"timehours\":\"(\d+).+?:\"(\d+).+?:\"(\d+)\"}/\1:\2:\3/g" | table test