Separating the string in the field

[mayank101]

I have various search string under the field name entity:

        Entity
 1   ABC:BOOT2NDSUNQTR_MAINT4_sfsdfdsfsdf
 2   FSD:BOOT2NDSUNMONTH_MAINT3_erewrewre
 3    AFE:BOOTALLSUNMONTH_MAINT1_SecProd_DEV_sdfsdfdsf

and so on..
I want field such as BOOT2NDSUNQTR,BOOT2NDSUNMONTH_MAINT3 to be separated out and put it into a different field called jobname.Can you please help me in writing the regex for the same

[vnravikumar]

Hi

Try this

| makeresults 
| eval test="ABC:BOOT2NDSUNQTR_MAINT4_sfsdfdsfsdf,FSD:BOOT2NDSUNMONTH_MAINT3_erewrewre,AFE:BOOTALLSUNMONTH_MAINT1_SecProd_DEV_sdfsdfdsf" 
| makemv test delim="," 
| mvexpand test 
| rex field=test "\:(?P<test>[\S]+)" 
| eval result=split(test,"_") 
| eval jobName =mvindex(result,0)."_".mvindex(result,1) 
| table jobName

[Vijeta]

@mayank101 See example below

| makeresults |eval Entity=" ABC:BOOT2NDSUNQTR_MAINT4_sfsdfdsfsdf"| rex field=Entity "(?<jobname>\S+_\S+)_"