Hello,
This is my character string user=YHYIFLP@intra.bcg.local i want to display just YHYIFLP, i use
| eval user=trim(user, "@intra.bcg.local") he doesn't work verry well. it's possible to use regex?
Thanks.
Simplest regex you can use could be this:
| rex field=user "^(?<justUser>[^\@]+)"
Which will extract just the user from the field user into a new field named justUser.
A more accurate and faster regex would be something like https://www.regextester.com/19
Hope that helps,
J
Thanks you all,
it works
Hi
Try this
| makeresults
| eval user="YHYIFLP@intra.bcg.local"
| rex field=user "(?P<user>^[^@]+)"
or
| makeresults
| eval user="YHYIFLP@intra.bcg.local", result = mvindex(split(user,"@"),0)
Here is one way to do it
| makeresults
| eval user="YHYIFLP@intra.bcg.local"
| rex field=user "(?<username>[^@]+)@.*"
| table user username
Simplest regex you can use could be this:
| rex field=user "^(?<justUser>[^\@]+)"
Which will extract just the user from the field user into a new field named justUser.
A more accurate and faster regex would be something like https://www.regextester.com/19
Hope that helps,
J