Need help on Regex for a field

[tdavison76]

Hello,  I am just trying to do a regex to split a single field into two new fields.

The original field is:

alert.alias = STORE_176_RSO_AP_176_10

I need to split this out to 2 new fields.

First field = STORE_176_RSO

Second field = AP_176_10

I am horrific at regex and am not sure how I can pull this off.  Any help would be awesome. 🙂 

Thank you for your help,

Tom

[gcusello]

Hi @tdavison76 ,

if the structure of your field is always the same:

field1=chars_numbers_chars

separator=_

field2=chars_numbers_numbers

you can use a regex like the following:

| rex field=alert.alias "^(?<field1>\w+_\d+_\w+)_(?<field2>\w+_\d+_\d+)"

Ciao.

Giuseppe

[tdavison76]

Awesome, thank you very much, that did the trick.  I screwed up a little, after I tested it, I realized that I was wrong, the originating field can be like one of the following:

alert.alias = STORE_8102_BOXONE_MX_8102

alert.alias = STORE_8102_BOXONE_MX_8102_01

Is there a regex for the second field that would just capture everything after that third "_"?

Thanks again, really appreciate the help,

Tom

[yuanliu · Accepted solution]

You can use the regex approach as @gcusello suggested, with a small modification:

| rex field=alert.alias "(?<field1>[^_]+(_[^_]+){2})_(?<field2>.+)"

Because the string is strictly formatted, you can also use split to achieve the same.  Depending on number of events you handle, the following could be more economical.

| eval elements = split('alert.alias', "_")
| eval field1 = mvjoin(mvindex(elements, 0, 2), "_"), field2 = mvjoin(mvindex(elements, 2, -1), "_")

Here is an emulation:

| makeresults format=csv data="alert.alias
STORE_8102_BOXONE_MX_8102
STORE_8102_BOXONE_MX_8102_01"

Either of the above searches gives

alert.alias	field1	field2
STORE_8102_BOXONE_MX_8102	STORE_8102_BOXONE	BOXONE_MX_8102
STORE_8102_BOXONE_MX_8102_01	STORE_8102_BOXONE	BOXONE_MX_8102_01

[tdavison76]

Hello,

Thank you very much for all of the details, that did the trick and I can finally move on to the next task.

Thanks again,

Tom