HI,
How to extract the field "AppGUID-{9BE518E6-ECC6-35A9-88E4-87755C07200F}" from the below field
ComputerName-DJ001DJKWN03-AppGUID-{9BE518E6-ECC6-35A9-88E4-87755C07200F}
As asked:
(AppGUID-\{[^\}]+\})
As I suspect desired:
AppGUID-(?<AppGUID>\{[^\}]+\})
@kiran331 - Did one of the answers below help provide a solution your question? If yes, please click “Accept” below the best answer to resolve this post and upvote anything that was helpful. If no, please leave a comment with more feedback. Thanks.
As asked:
(AppGUID-\{[^\}]+\})
As I suspect desired:
AppGUID-(?<AppGUID>\{[^\}]+\})
try like this:
|stats c|eval _raw="ComputerName-DJ001DJKWN03-AppGUID-{9BE518E6-ECC6-35A9-88E4-87755C07200F}"|rex field=_raw "AppGUID..(?\w{8}-\w{4}-\w{4}-\w{4}-\w{12})"
Assuming the field is called guid:
| rex field=guid "^ComputerName-.[^-]+-(?P[^\$]+)"