How to extract IDs?

[beepbop]

I have a field called APM_ID and i want to get the output for only APMs from this field (for eg: A1002, A0001) and want to group the rest of the output as "shared service". What query can i write for the desired output?

APM_ID

ABCDE-FVG-HH

HBBB-NDBXB-SM

A1001

SBSKS

A0002

JJSKM

A0009

A2002

[woodcock]

|makeresults
| eval APM_ID = "ABCDE-FVG-HH HBBB-NDBXB-SM A1001 SBSKS A0002 JJSKM"
| rex max_match=0 field=APM_ID "(?<APM>A\d{4})"

[rut]

@beepbop  The following would group by id or "shared service", the regex may need to be a bit more strict depending on the field values.

| eval APM_ID_GROUP=if(match(APM_ID, "^[A-Z]\d+$"), APM_ID, "shared service")
| stats values(APM_ID) as APM_ID by APM_ID_GROUP