Need help with regular expression/rex

[jameskerivan]

Hi,

Sorry I am having a tough time with this regular expression. I have a field named transaction_type and there are values in the field I want to extract. The field looks like this fieldA||fieldB||fieldC||fieldD. Now I want to be able to look at each individual field. I am having a tough time understanding how regular expressions work.

basic query | rex field=transaction_type "(?FieldB.*)||(?FieldC.*)" | table transaction_type FieldB

So I want my delimiter to be ||. I have tried multiple combinations and nothing is coming out as I expect it to.

Thank you for your help!

[Richfez · Accepted solution]

(Edits: sorry, editor kept eating my fields)

One problem is escaping. The pipes | need to be escaped with a preceding \ character.

... | rex field=transaction_type "(?<f1>.*)\|\|(?<f2>.*)\|\|(?<f3>.*)\|\|(?<f4>.*)"

That takes an existing field that is already called "transaction_type" and looks like this: fieldA||fieldB||fieldC||fieldD and splits it into 4 parts named f1, f2, f3 and f4. There are quite a few ways to skin this particular cat, but that is probably the simplest regex way.

I'd suggest spending some time at a regex tutorial site, like perhaps here.
Here's a fun site to play with once you've done a bit of the tutorial.

[jameskerivan]

Thank you! I appreciate it.