Hi,
How can I retrieve nth word in a string using rex or other alternatives?
For example:
"ABC BBC XYZ QAS"
"POP IMP RIL WER"
I want to extract XYZ and RIL here. Please note that they will always be the 3rd word but number of characters before them can vary.
Easy
yoursearchhere
| rex field=youroldfield "\S+\s+\S+\s+(?<yournewfield>\S+)\s"
Easy
yoursearchhere
| rex field=youroldfield "\S+\s+\S+\s+(?<yournewfield>\S+)\s"
Thanks MuS for a great suggestion.
try
| rex field=youroldfield "(\S+\s+){19}(?<yournewfield>\S+)\s"
this will match 19 times a group of any character that is not a whitespace character followed by spaces, the next match will be your 20th field 😉
Thanks Iguinn. That worked and you saved my day!!.
Is there a way we can generalize number of \S+\s+ instead of keep it adding to extract say 20th word?