Hello my loves I have one quick question
Lets say I have this two strings
AUJ.UEIEJ.829839.239383
033.4788383.27383.8HJJJ
WHat would be the correct regex expression to extract ONLY string of characters after the first dot and before the second dot.. that means
from AUJ.UEIEJ.829839.239383 I want UEIEJ
from 033.4788383.27383.8HJJJ I want 4788383
Thank you my loves for the help!
kindly,
C
| rex "^[\.]+\.(?<string>[^\.]+)\."
Can you try this?
| makeresults
| eval x="AUJ.UEIEJ.829839.239383"
| rex field=x "\.(?<field1>.+?)\."
---
An upvote would be appreciated if this reply helps and Accept the solution!
@cindygibbs_08 Assumed your field name as x (replace with your field name) which containing a string value. If the string is part of _raw event and not been extracted already this might not work.