Hi,
Sorry I am having a tough time with this regular expression. I have a field named transaction_type and there are values in the field I want to extract. The field looks like this fieldA||fieldB||fieldC||fieldD
. Now I want to be able to look at each individual field. I am having a tough time understanding how regular expressions work.
basic query | rex field=transaction_type "(?FieldB.*)||(?FieldC.*)" | table transaction_type FieldB
So I want my delimiter to be ||
. I have tried multiple combinations and nothing is coming out as I expect it to.
Thank you for your help!
(Edits: sorry, editor kept eating my fields)
One problem is escaping. The pipes |
need to be escaped with a preceding \
character.
... | rex field=transaction_type "(?<f1>.*)\|\|(?<f2>.*)\|\|(?<f3>.*)\|\|(?<f4>.*)"
That takes an existing field that is already called "transaction_type" and looks like this: fieldA||fieldB||fieldC||fieldD
and splits it into 4 parts named f1, f2, f3 and f4. There are quite a few ways to skin this particular cat, but that is probably the simplest regex way.
I'd suggest spending some time at a regex tutorial site, like perhaps here.
Here's a fun site to play with once you've done a bit of the tutorial.
(Edits: sorry, editor kept eating my fields)
One problem is escaping. The pipes |
need to be escaped with a preceding \
character.
... | rex field=transaction_type "(?<f1>.*)\|\|(?<f2>.*)\|\|(?<f3>.*)\|\|(?<f4>.*)"
That takes an existing field that is already called "transaction_type" and looks like this: fieldA||fieldB||fieldC||fieldD
and splits it into 4 parts named f1, f2, f3 and f4. There are quite a few ways to skin this particular cat, but that is probably the simplest regex way.
I'd suggest spending some time at a regex tutorial site, like perhaps here.
Here's a fun site to play with once you've done a bit of the tutorial.
Thank you! I appreciate it.