I don't understand how Splunk does regex!
I have this search below:
...
| spath output=test path=a.b.c
| rex field=test "?<test1>[0-9]+"
| table test, test1
Test is this: {"timehours":"16","timeminutes":"34","timeseconds":"11"}
How do I extract just the numbers and semicolon except the first semicolon?
Thanks!
Try this
...
| spath output=test path=a.b.c
| rex max_match=3 field=test "(?<t>\d{1,2})"
| eval test1=mvindex(t, 0).":".mvindex(t, 1).":".mvindex(t, -1)
| table test, test1
Here's another way. Still couldn't get it in just one rex.
This generates test results -
| makeresults | eval testfield="{\"timehours\":\"16\",\"timeminutes\":\"34\",\"timeseconds\":\"11\"}"
This pulls out the time parts -
| rex field=testfield max_match=3 "(?<mytime>\d{1,2})" | eval mytime=mvjoin(mytime,":")
Try this
...
| spath output=test path=a.b.c
| rex max_match=3 field=test "(?<t>\d{1,2})"
| eval test1=mvindex(t, 0).":".mvindex(t, 1).":".mvindex(t, -1)
| table test, test1
That works but is there a way to do it all in rex? Thanks.
With rex mode=sed
you cannot assign the result to a different field. Try this
... | rex mode=sed field=test "s/{\"timehours\":\"(\d+).+?:\"(\d+).+?:\"(\d+)\"}/\1:\2:\3/g" | table test