In this search
index=xxx sourcetype=yyy CSI_ID="1234"| rex field=COMPONENT_ID mode=sed "s/(.*)(\..*){4}/\1/"| table COMPONENT_ID
There are 3 portion of the rex command regular expression
s/
:- this denotes that its a string replacement. (y will be used for character replacement)(.*)(\..)){4}/
:- this identifies two part of in the values of field COMPONENT_ID, 2nd part is the extension starting with dot and 3 more character, 1st part is everything else before that. [so if COMPONENT_ID="D:\foo\bar\tbd.log"
, then first part is "D:\foo\bar\tbd"
and 2nd part is ".log"
]\1/
:- this part specifies which part will be retained from the parts identified by expression mentioned in 2nd point. So \1
means only the first part (without extension) will be retained. Last slash is to end the replacement section.So if you run the following
| gentimes start=-1 | eval COMPONENT_ID="D:\foo\bar\tbd.log" | rex field=COMPONENT_ID mode=sed "s/(.*)(\..*){4}/\1/"| table COMPONENT_ID
The output will be "D:\foo\bar\tbd"
\1 is for backreference