How to use rex out the below text ?

[m7787580]

Full or partial cease : </strung></td> <td width="100%" galign="top" >Full<

I would like to extract the below text using rex command and save it in field as cease in the below example ?
Starting after cease of Full or partial cease and ending where is the last character.here it is &It;

It will look like below.
Cease= </strung></td> <td width="100%" galign="top" >Full<

Help would be highly appreciated

Regards,

[damiensurat]

Hi m7787580, Depending on the format of the search string, one or all of these should work. I would like to point out that when using the rex command, it is good to indicate which field you intend on extracting data from. For EG: rex field=MyHTMLStringData ".Cease=.>(?\w*)<"

These are the rex without the field parameter defined, but you can put it in at any point. Have a great day =)...

... | rex ".Cease=.>(?\w*)<"

OR 


... | rex "Full or partial cease Cease=.*>(?<Cease>\w*)<"


OR


... | rex ">(?<Cease>\w*)<"

[damiensurat]

... | rex" Full or partial cease Cease=.*>(?<Cease>\w*)<"

[m7787580]

Hi All,
There is sudden change i requirement now i have to fetch only >Full< from the text mentioned above.

New field= >Full<

I tried but its not working for me.

Many thanks in advance

[damiensurat]

... | rex "Full or partial cease\s*:\s*Cease=.*>(?\w*)<"

[m7787580]

I am getting below error.

Error in 'rex' command: Encountered the following error while compiling the regex 'Full or partial cease\s*:\s*Cease=.>(?\w)<': Regex: unrecognized character after (? or (?-

[damiensurat]

Please remember to Hit accepted answer and the up arrow.... thanks and have a great day. Hope it helped...

[m7787580]

I tried to use your below query

rex "Full or partial cease\s*:\s*Cease=.>(?\w)<"|table NewFieldName

But it's not giving me any result.
Thanks for your help in advance

[m7787580]

this is the exact full text

Full or partial cease : </strong></td>
<td width="60%" valign="top"
>Full</td>
</tr>

[damiensurat]

Perfect, one other question... Is this event in a single string format, or is it logged with line breaks?

[m7787580]

I guess it is logged with line breaks

[damiensurat]

    Hi  m7787580,  Depending on the format of the search string, one or all of these should work.  I would like to point out that when using the rex command, it is good to indicate which field you intend on extracting data from.  For EG: rex field=MyHTMLStringData ".*Cease=.*>(?<Cease>\w*)<"

    These are the rex without the field parameter defined, but you can put it in at any point.  Have a great day =)...

     ... | rex ".*Cease=.*>(?<Cease>\w*)<"


        OR 


        ... | rex "Full or partial cease Cease=.*>(?<Cease>\w*)<"


        OR


        ... | rex ">(?<Cease>\w*)<"

[damiensurat]

sorry about that, I entered as text and not code and some bits were removed. I have resubmitted as an answer, which is what you are looking for. Should be available shortly.

[m7787580]

Thanks for helping.
I am gladly waiting for your answer 🙂

[woodcock · Accepted solution]

Like this:

... | rex "Full or partial cease\s*:\s*(?<Cease>.*)"

[m7787580]

Hi Woodcock,

There is sudden change i requirement now i have to fetch only >Full< from the text mentioned above.

New field= >Full<

I tried but its not working for me.

Many thanks in advance

[woodcock]

So your data is like this:

Full or partial cease : </strong></td> 
<td width="60%" valign="top" 
>Full</td> 
</tr> 

So try this:

| makeresults 
| eval _raw="Full or partial cease : </strong></td> 
<td width=\"60%\" valign=\"top\" 
>Full</td> 
</tr>"

| rename COMMENT AS "Everything above fakes test data; everything below is your solution"

| rex "(?ms)Full or partial cease\s*:\s*.*?<td.*?>(?<MyValue>.*?)</td>"

[damiensurat]

nice use of makeresults woodcock!