suppose i had data like below field="_raw"
afadfadfadf
afadsfagafg
adfafafa
string1 .........
afjal;dkfhao ilhaf
ajkf;haldghag;lakg
akuhfajkdhfalkfha;
auhaghkajdgakg
jkalfagafg
string2.........
afdasdgadfas
**bleep**adgafgafgaf
agfgertfergreg
And i want to extract the data in between string1 and string2
Hi @satya671
| makeresults
| eval _raw="afadfadfadf
afadsfagafg
adfafafa
string1 .........
afjal;dkfhao ilhaf
ajkf;haldghag;lakg
akuhfajkdhfalkfha;
auhaghkajdgakg
jkalfagafg
string2.........
afdasdgadfas"
| rex "string1(?<extracted>(.|\n)*?)string2"
| table extracted
You could try this.
Hi @satya671
| makeresults
| eval _raw="afadfadfadf
afadsfagafg
adfafafa
string1 .........
afjal;dkfhao ilhaf
ajkf;haldghag;lakg
akuhfajkdhfalkfha;
auhaghkajdgakg
jkalfagafg
string2.........
afdasdgadfas"
| rex "string1(?<extracted>(.|\n)*?)string2"
| table extracted
You could try this.
Thanks @venkatasri it's working as expected 🙂