I have a field that looks like the below.
PM=Rodhouse,Logan (PM Build VZT-PM)
PM=Allen,Jim (PM Run-PM)
Basically breaksdown like the below.
PM= Last,First Name (PM "Group"-PM)
I would like to create a custom field for the Any Text that is in the "Group" Part.
PMGroup="Group"
PMGroup=Build VZT
PMGroup=Run
Any help would be appreciated.
Try the following rex command
<YourBaseSearch>
| rex "\(PM\s(?<PMGroup>[^\-]+)\-PM\)"
You can create a Field Extraction with the same regular expression once you have tested with your sample data. You can also use regex101.com for understanding how this regex is working.
Try the following rex command
<YourBaseSearch>
| rex "\(PM\s(?<PMGroup>[^\-]+)\-PM\)"
You can create a Field Extraction with the same regular expression once you have tested with your sample data. You can also use regex101.com for understanding how this regex is working.
This worked perfect but for some reason I had to add field=PM for it to extract properly.
| rex field=PM "\(PM\s(?<PMGroup>[^\-]+)\-PM\)"
Ok my query was for raw data so it should have also worked, but field=PM would work as well. Eventually create a field extraction with regex using Interactive Field Extraction or props.conf/transforms.conf whichever you are comfortable with.