Regex Help!

[NShimmen]

Hi!

First time I am attempting Regex commands and I have got pretty stuck so any help would be much appreciated. I have a string data that appears in a table as "Network User::(FirstName).(Surname)".

How could I use the regex command to get rid of Network User and just display the first and second name in the results table?

So my search would be something like:

...| stats count by user|regex......| table user, count

Thanks!

[p_gurav]

Can you try something:

...| stats count by user| rex field=user mode=sed "s/Network User::*//g" | table user, count

[TISKAR]

Hello,
Try this:

.| stats count by user | rex field=a "::\((?<FirstName>[^.)]*)\)\.\((?<Surname>[^.)]*)"

For Example:

| makeresults |eval a= "Network User::(FirstName).(Surname)" | rex field=a "::\((?<FirstName>[^.)]*)\)\.\((?<Surname>[^.)]*)"

[damien_chillet]

An example of regex extraction that would work with the example string you provided:

| rex field=user "::\((?P<first_name>[^\)]+)\)\.\((?P<surname>[^\)]+)\)"

[David_Naylor]

Try to get those field extractions done. You can do it inline with the following
|rex "Network\sUser::(?P\w+)).((?P\w+)) | table FirstName,Surname,count