i want to extract field by regular expression. how can i write regular expression for the below one?
"responseCode":"200"
Try this
your base search | rex "\"responseCode\":\"(?<response_code>\d+)"
Based on the same data, it seems your data may be json format and you can get the fields extracted automatically (or you can set that up). Is it a proper json?
Hi sravankaripe,
| rex field=_raw "(?:.*responseCode\s?\:\s?)(?<response_code>\d+)"
Gives you a field with the name "response_code" with the specific value.
Let me know if it works and check out this great site
https://regex101.com
Regards,
pyro_wood
PS:.... god damn.... somesoni at it again, stealin my karma 😄
Try this
your base search | rex "\"responseCode\":\"(?<response_code>\d+)"
Based on the same data, it seems your data may be json format and you can get the fields extracted automatically (or you can set that up). Is it a proper json?