Hi ,
I have a field with VendorName
Example :
HOMOLOGATED-(Contrend CT 5072s)
HOMOLOGATED-(DLINK-DLINK 500B C1) @ HOMOLOGATED-(DLINK-DLINK 500B C2) @ HOMOLOGATED-(OPTICOM-DLINK 279)
I want to extract only the message inside the brackets,my output should be
Contrend CT 5072s
DLINK-DLINK 500B
OPTICOM-DLINK 279
If i have two messages in single field Example "(DLINK-DLINK 500B C1) @ HOMOLOGATED-(DLINK-DLINK 500B C2)". I want only first message within the brackets
output-DLINK-DLINK 500B
Can anyone help me how to write rex command for this..?
Thanking you in advance
Try this
your base search | rex field=yourfield "\((?<VendorName>.*)(\)$| \w+\) @ )"
This takes care of multiple message in the field as well.
Try this
your base search | rex field=yourfield "\((?<VendorName>.*)(\)$| \w+\) @ )"
This takes care of multiple message in the field as well.
Thanks for your answer,
i have tried the above rex, i am getting the output as
DLINK-DLINK 500B C1) @ HOMOLOGATED-(DLINK-DLINK 500B C2) @
but as i told if there are multiple brackets it should consider only the message within the first brackets only.
Required output should be
DLINK-DLINK 500B
Please help me in this...
try this one (Tested, it picks only the first parenthesis group)
| rex field=mysourcefield "\((?<VendorName>[^\)]*)\)" | table VendorName mysourcefield
It will however extract everything in the parenthesis
HOMOLOGATED-(DLINK-DLINK 500B C1) @ HOMOLOGATED-(DLINK-DLINK 500B C2) @
-> DLINK-DLINK 500B C1
for selective extraction see the answer from @somesoni2