Hi, One of my value in table is being passed as an Boolean expression as below
(assignmentgroup = 1213AppDevelopment1 OR assignmentgroup = App-Testing OR assignmentgroup = App Support OR assignmentgroup = App:Support OR assignmentgroup = App&$+*Support assignment_group = AppSupport)
I'm trying to use the | makemv tokenizer= to make the above to be extracted as multivalues as below
And then use mxexpand to appy other table values to the expanded fields.
Can anyone help me with the Regex to do so.
|makeresults | eval _raw="(assignment_group = 1213App_Development1 OR assignment_group = App-Testing OR assignment_group = App Support OR assignment_group = App:Support OR assignment_group = App&$+*Support assignment_group = AppSupport)" | rex max_match=0 "assignment_group\s*=\s*(?<assignment_group>[^\s\)]+)"
Avoid the use of
mvexpand; it does not scale well and will cause false results. All of the
*stats commands are
multivalue-aware and will do the right thing so just leave it as
Many Thanks @woodcock , extraction is working as expected expect if there is a white space between the values.. included am additional \s.
| rex maxmatch=0 "assignmentgroup\s=\s(?\s[^OR)]+)"