Remove Plus Sign In Regex

[IRHM73]

Hi,

I wonder whether someone may be able to help me please.

I currently have the following raw data:

service=ma&report-name=fred+&report-email=77777777777&report-action=i+earn+as+i+work+31+hours+a+week+and+my+husband+does+not+work+at+all+and+has+no+money+coming+in+&report-error=how+to+work+out+what+we+can+claim&isJavascript=true&referrer=https%3A%2F%2Fwww.uk%2Fapplication%2Fcalculator

What I'd like to is extract the after "action=" up to but excluding "&isJavascript". I would also like to exclude the '+' sign so that the text is one long string.

Using "Regex101", I've put together the following:

action=(?<comments>[^$]+)\&is

But the problem I have is that I cannot remove the '+' signs.

I just wondered whether someone could look at this please and offer some guidance on how I may be able to achieve this.

Many thanks and kind regards

Chris

[ddrillic]

eval decode=urldecode(_raw) should convert the + signs to spaces...

[ddrillic]

Chris, keep in mind please that you can use the Field Extractor feature for such cases - most powerful.

[IRHM73]

Hi @ddrillic, thank you for taking the time to reply to my post and for the information. I hadn't realised that.

Kind Regards

Chris

[javiergn · Accepted solution]

Hi, your regex is fine. Simply add another line to replace the + sign:

yoursearch
| rex field=_raw "action=(?<comments>[^$]+)\&is"
| eval comments=replace(comments, "\+", "")

Thanks,
J

[IRHM73]

Hi @javiergn, thank you very much, it works great.

Kind Regards

Chris