I have a field that is of the form /Code153:4:Item1,Item2,Item3,Item4/Code211:2:Item5,Item6
where I need to extract a substring in the form of Code###:#:Item,Item,Item....
based upon the location of a search. For example, if it was Item 2 I was searching for then the string Code 153:4:Item1,Item2:Item3:Item4
would be returned.
I am stumped on how to accomplish this.
Try like this
your current search | eval yourfield=split(yourfield,"/") | eval filteredVal=mvfilter(match(yourfield,"Item2"))
Try like this
your current search | eval yourfield=split(yourfield,"/") | eval filteredVal=mvfilter(match(yourfield,"Item2"))