Hello, I am new to using REX wich is I believe is what I need. I have a field that has data that looks like this...
10.231.247.162--WTLDNDAA001--Can't ping DSLAM
10.44.69.250--TCSUAZMS--VisibilityOnly--Can't ping DSLAM
10.44.69.250--TCSUAZMS--Can't ping DSLAM--VisibilityOnly
172.31.247.148--CLSPCO32H01.2--Can't ping DSLAM
172.31.166.155--RSBGORBU--Can't ping DSLAM
I want my table to ONLY show whats between the hyphens
Example I want to get
WTLDNDAA-001
TCSUAZMS
CLSPCO32H01.2
RSBGORBU
Can anybody help me with creating a rex that removes everything not between the the 2 sets of hyphens.
Would be greatly appreciated!!
The regex I would use is :
--(?<myfield>[^-\n]+)--
You can see it in action here:
https://regex101.com/r/AbOMKk/1
or you can test it with SPL here:
| makeresults | eval data=split("10.231.247.162--WTLDNDAA001--Can't ping DSLAM%%10.44.69.250--TCSUAZMS--VisibilityOnly--Can't ping DSLAM%%10.44.69.250--TCSUAZMS--Can't ping DSLAM--VisibilityOnly%%172.31.247.148--CLSPCO32H01.2--Can't ping DSLAM%%172.31.166.155--RSBGORBU--Can't ping DSLAM", "%%")| mvexpand data | rex field=data "--(?<myfield>[^-\n]+)--"
but as this looks like you are extracting the host, I would recommend using a props/transforms combination:
props.conf
[mysourcetype] TRANSFORMS-hostoverride=mysourcetype_hostoverride
transforms.conf
[mysourcetype_hostoverride] DEST_KEY = MetaData:Host REGEX = ^\d+\.\d+\.\d+\.\d+--(?<myfield>[^-\n]+)-- FORMAT = host::$1
This regex can be tested here:
The regex I would use is :
--(?<myfield>[^-\n]+)--
You can see it in action here:
https://regex101.com/r/AbOMKk/1
or you can test it with SPL here:
| makeresults | eval data=split("10.231.247.162--WTLDNDAA001--Can't ping DSLAM%%10.44.69.250--TCSUAZMS--VisibilityOnly--Can't ping DSLAM%%10.44.69.250--TCSUAZMS--Can't ping DSLAM--VisibilityOnly%%172.31.247.148--CLSPCO32H01.2--Can't ping DSLAM%%172.31.166.155--RSBGORBU--Can't ping DSLAM", "%%")| mvexpand data | rex field=data "--(?<myfield>[^-\n]+)--"
but as this looks like you are extracting the host, I would recommend using a props/transforms combination:
props.conf
[mysourcetype] TRANSFORMS-hostoverride=mysourcetype_hostoverride
transforms.conf
[mysourcetype_hostoverride] DEST_KEY = MetaData:Host REGEX = ^\d+\.\d+\.\d+\.\d+--(?<myfield>[^-\n]+)-- FORMAT = host::$1
This regex can be tested here:
That worked, Thank you