Hi,
I wonder whether someone may be able to help me please.
I currently have the following raw data:
service=ma&report-name=fred+&report-email=77777777777&report-action=i+earn+as+i+work+31+hours+a+week+and+my+husband+does+not+work+at+all+and+has+no+money+coming+in+&report-error=how+to+work+out+what+we+can+claim&isJavascript=true&referrer=https%3A%2F%2Fwww.uk%2Fapplication%2Fcalculator
What I'd like to is extract the after "action=" up to but excluding "&isJavascript". I would also like to exclude the '+' sign so that the text is one long string.
Using "Regex101", I've put together the following:
action=(?<comments>[^$]+)\&is
But the problem I have is that I cannot remove the '+' signs.
I just wondered whether someone could look at this please and offer some guidance on how I may be able to achieve this.
Many thanks and kind regards
Chris
Hi, your regex is fine. Simply add another line to replace the + sign:
yoursearch
| rex field=_raw "action=(?<comments>[^$]+)\&is"
| eval comments=replace(comments, "\+", "")
Thanks,
J
eval decode=urldecode(_raw) should convert the + signs to spaces...
Chris, keep in mind please that you can use the Field Extractor feature for such cases - most powerful.
Hi @ddrillic, thank you for taking the time to reply to my post and for the information. I hadn't realised that.
Kind Regards
Chris
Hi, your regex is fine. Simply add another line to replace the + sign:
yoursearch
| rex field=_raw "action=(?<comments>[^$]+)\&is"
| eval comments=replace(comments, "\+", "")
Thanks,
J
Hi @javiergn, thank you very much, it works great.
Kind Regards
Chris