Hi
I want to exclude the field values starting with "note-" and more than 15 characters after it. How can I write the regex for this.
eg:
device
note-acv234454dfgdfg
note-dfdffgfghffe4353456
Does it have to be in regex? You could extract all the fieldvalues and then filter out using where
Like this
... | rex (?<device>captureeverything> | where NOT match(device, "note*") OR len(device)<15
You can try like this
your base search | regex yourfield!="^note-\w{15}.*"
Does it have to be in regex? You could extract all the fieldvalues and then filter out using where
Like this
... | rex (?<device>captureeverything> | where NOT match(device, "note*") OR len(device)<15