I want to extract the substring: "xenmobile" from string: "update task to xenmobile-2021-11-08-19-created completed!", how can I get that?
| makeresults
| eval foo = "update task to xenmobile-2021-11-08-19-created completed!"
| rex field=foo "update task to (?<bar>[^-]+)"
| replace "xenmobile" WITH "" IN field
| makeresults
| eval foo = "update task to xenmobile-2021-11-08-19-created completed!"
| rex field=foo "update task to (?<bar>[^-]+)"