How to filter name by id which start with a specific number?

[eduspk]

Hi All

Please help me with rex to filter name by id which start with "9" .

Ex:

Sample log

ContactId:"12345,5678,9999",ContactName:"name1,name2,name3"

Result:

id name
9999 name3

[vnravikumar · Accepted solution]

Hi @eduspk

Try the following and let me know

| makeresults 
| eval log="ContactId:\"12345,9345,9999\",ContactName:\"name1,name2,name3\"" 
| rex field=log "ContactId:\"(?P<id>.+)\"\,ContactName\:\"(?P<name>.+)\"" 
| makemv delim="," id 
| makemv delim="," name 
| eval temp =mvzip(id,name) 
| mvexpand temp 
| rex field=temp "(?P<id>\d.+)\,(?P<name>.+)" 
| regex id="^9.+" 
| table id name

[eduspk]

Works fine. Thanks