How to split and retrieve a value ?

[zacksoft]

I think we may need regex for this and I am not good at it.
I need to be able to extract the last part i.e. (TMNT-1752) from the below string . In some cases the numeric part could be three or more digits too like CMNU-112 or NT=1223 etc or TURC-12223. I think I want the part that comes after selectedIssue=.

https://phut.mayhem.com/secure/JapidJoard.jspa?rapidView=12339&view=detail&selectedIssue=TMNT-1752

[nikita_p]

Hi @,
I think the regex above should work for you but still if it's not you can try below regex.
index=xyz | rex field=url "\"(selected\w+)\"[=]*(?P(([^&]+)|(.+)))\""

[p_gurav · Accepted solution]

Hi,

Can you try this :

  | rex field=url "selected\w+=(?<value>(([^\&]+)|(.+)))"

OR

  | rex field=_raw "selected\w+=(?<value>(([^\&]+)|(.+)))"

[zacksoft]

Thanks @p_gurav

[p_gurav]

Welcome. 🙂

[DavidHourani]

Hi man,

This should work for you :

  | rex field=url "selectedIssue\=(?<value>[^\&]+)" 

Best regards,
David

[zacksoft]

What if the string I am looking for is between "selected=" and "&"

example : selectedIssue=TWNT1752&
selectedDefect=TMNT1752
selectedGarfi=TMNT1234
selectedEpic=TMNT1234

How do I extract it ?

[DavidHourani]

Ah from what I read I saw you needed selected issue only.

Simplest form is:

  | rex field=url "selected\w+=(?<value>[^\&]+)" 

[p_gurav]

Hi zacksoft,

In example string is "pelectedIkkue=" constant? If yes then you can try below one:

| rex field=_raw "selectedIssue\=(?P<field1>.+)"

[zacksoft]

If I try this , where will it extract TMNT-1752 to ?
I need to able to use the value and put it in a table.

[p_gurav]

it will extract into "field1".. which you can use in the search

[zacksoft]

@p_gurav
Actually it's not _raw. The entire string itself is stored in a field caleld "url".
What changes do I make for that ?

[p_gurav]

Then used below:

 | rex field=url "selectedIssue\=(?P<field1>.+)"

[zacksoft]

A small change ... I see in some of the strings there are some values that are present after TMNT-1752 and they begin with '&' and that messes up the extract. Can I filter those ?

Example : https://phut.mayhem.com/secure/JapidJoard.jspa?rapidView=12339&view=detail&selectedIssue=TMNT-1752&m...

The current query's output is "TMNT-1752&myReq=1234somethingsomething"

Can we just get the part present between "selectedIssue=" and "&"

[p_gurav]

Then try this, It will create field called value which you can use in search:

  | rex field=url "selectedIssue\=(?<value>(([^\&]+)|(.+)))" 

OR

    | rex field=_raw "selectedIssue\=(?<value>(([^\&]+)|(.+)))" 

[zacksoft]

Yes, that is constant. The only value that changes is 'TMNT-1752'. It could be something like ABC-1233 or ABFD-121 etc...

[harsmarvania57]

Hi @zacksoft,

Please try <yourBasesearch> | rex ".*=(?<value>.*)" this will extract TMNT-1752 into new field value

Here is run anywhere search, first 2 lines generating dummy data only.

| makeresults 
| eval _raw="https://phut.mayhem.com/secure/JapidJoard.jspa?rapidView=12339&view=detail&pelectedIkkue=TMNT-1752" 
| rex ".*=(?<value>.*)"

[zacksoft]

There is another "=" sign before "rapidView". But I don't want that value. I only want the last one that comes after 'selectedIssue='

[harsmarvania57]

Can you please post your full event instead of part of event so that we can write regex properly.

[zacksoft]

The string itself is extracted from _raw and stored in a field called 'url'.
And url field is as follows. I need the string that is present after 'selectedIssue='

https://phut.mayhem.com/secure/JapidJoard.jspa?rapidView=12339&view=detail&selectedIssue=TMNT-1752"