A result of a search for a field resourceId is
/SUBSCRIPTIONS/9B8874C9-5DC3-46CE-908A-D00EE594A4EC/PROVIDERS/MICROSOFT.SECURITY/LOCATIONS/WESTEUROPE/ALERTS/2518432613670999141_1736EDA9-63D3-4CD2-8E54-79828127B011
I only want to see the result after the last /
So: 2518432613670999141_1736EDA9-63D3-4CD2-8E54-79828127B011
What's the way to do this?
Use the rex
command. Here is one way. others may find a better one.
... | rex "(?:\/[^\/]+)+\/(?<field>.*?$)" | ...
Tx...this helps indeed
Martin
If your problem is resolved, please accept the answer to help future readers.