Hi all,
I'm attempting to develop a regex that will pick up on a value contained in [ ] brackets (see below):
Log value
year number time:time:time 00 AAA0 Blah Blah Blah Blah Blah: [X] to [Y] (4 possible variables X,Y,A,B)
I need to alert every time the * to [ bracketed value] changes. Trying to make a regex to pick out these bracketed values. Any help is appreciated!
Try this command to extract both values within brackets.
| rex "\[(?<bracket1>[^\]]+)\] to \[(?<bracket2>[^\]]+)"
It looks for the first bracket, extracts everything up to the second into field 'bracket1', then it looks for a closing bracket followed by " to " and a third bracket. Everything up to the fourth bracket is put into field 'bracket2'.
Try this command to extract both values within brackets.
| rex "\[(?<bracket1>[^\]]+)\] to \[(?<bracket2>[^\]]+)"
It looks for the first bracket, extracts everything up to the second into field 'bracket1', then it looks for a closing bracket followed by " to " and a third bracket. Everything up to the fourth bracket is put into field 'bracket2'.
That worked perfectly, thanks! 🙂