Rex removing a sub string is not working?

[johnnybillyd]

Hi,

Been banging my head on this brick wall for a while so reaching out for some of expertise. Seems pretty straightforward and regex101 says my expression should work, but I am not getting any data returned in the new field.

Original data  is:

18 dB, 16 dB, 12 dB, 12 dB, 12 dB, 13 dB, 4 dB, 8 dB, 9 dB, 9 dB
9 dB, 9 dB, 9 dB, 9 dB
9 dB
9 dB, 9 dB, 9 dB, 9 dB, 9 dB
7 dB, 9 dB

I'm trying to remove the space and the text dB after any number. So the results for the 4th event would read as 9, 9, 9, 9, 9 and the 5th event would be 7, 9

My search returns  the events, but no values for the new field:

|rex field=Value "\ dB(?<MicGainText>)"
|table Value MicGainText

If anyone could assist, it would be greatly appreciated. Thanks in advance

John

[johnnybillyd]

Hi @gcusello 

Thank you very much, that is now working!

It is stripping the comma delimiter, and stacking the values in the table, but I think I will be able to sort that out now  you have helped me get the basic rex working though.

Thanks again.

Kudos,

Regards,

John

[johnnybillyd]

Hi @gcusello

Thanks for responding.

Unfortunately, that's still not returning any results for the MicGainText field. 

Cheers,

John

[gcusello · Accepted solution]

Hi @johnnybillyd ,

sorry, please try this:

<your_search>
| rex field=Value max_match=0 "(?<MicGainText>\d+)\sdB"
| table Value MicGainText

that you can test at https://regex101.com/r/y9tTUs/1

Ciao.

Giuseppe

[gcusello]

Hi @johnnybillyd,

probably the regex you shared isn't complete, but it should be:

<your_search>
| rex field=Value max_match=0 "dB(?<MicGainText>\d+)"
| table Value MicGainText

Ciao.

Giuseppe