- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How to extract a string from a field that contains space characters?
talbs
New Member
01-20-2016
10:31 PM
Hello,
I would like to extract a string from a field which contains Space characters.
This is the Text Field that is already extracted:
<Text>Launched application: FilmView, PID: 5180</Text>
I used the following search:
rex field=Text ": (? Application> \w+) ,"
I didn't work for me. What should be the right command?
If it can be done, I would like to extract the PID field as well.
Thanks
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

javiergn
Super Champion
01-21-2016
09:03 AM
Try this:
| rex field=Text "application: (?<Application>[^\,]+)\, PID: (?<PID>\d+)"
