RegEx Extraction Assistance for new field.

[matt4321]

I have a field that looks like the below.

PM=Rodhouse,Logan (PM Build VZT-PM)
PM=Allen,Jim (PM Run-PM)

Basically breaksdown like the below.
PM= Last,First Name (PM "Group"-PM)

I would like to create a custom field for the Any Text that is in the "Group" Part.
PMGroup="Group"

PMGroup=Build VZT
PMGroup=Run

Any help would be appreciated.

[niketn · Accepted solution]

Try the following rex command

<YourBaseSearch>
|  rex "\(PM\s(?<PMGroup>[^\-]+)\-PM\)"

You can create a Field Extraction with the same regular expression once you have tested with your sample data. You can also use regex101.com for understanding how this regex is working.

[matt4321]

This worked perfect but for some reason I had to add field=PM for it to extract properly.

| rex field=PM "\(PM\s(?<PMGroup>[^\-]+)\-PM\)"

[niketn]

Ok my query was for raw data so it should have also worked, but field=PM would work as well. Eventually create a field extraction with regex using Interactive Field Extraction or props.conf/transforms.conf whichever you are comfortable with.