regex - remove comma from the result

[krusovice]

Hello all,

I have a problem extracting field using regex. The nearest query I've made is:

index=* | rex field=_raw "/application/(?<type>[\S+]+)" | stats count by type

However, the result extracted comes with a comma at the end. Example of result is

toy1,
/store/toy2,
/store/US/toy4,

What should I do to remove the comma ( , ) from the result?

Thanks.

[493669 · Accepted solution]

try this rex:

 index=* |rex "/application/(?<type>[^,]+)"

[krusovice]

Thank you, it works!