Hello,
I've been reading up on the rex
command and using it to split strings, but I cannot for the life of me get it working. I have the following input:
FORECAST
Sun and a few passing clouds. High 13C. Winds light and variable.
Partly cloudy. Low 4C. Winds light and variable.
Overcast with rain showers at times. High around 10C. Winds NE at 10 to 15 km/h. Chance of rain 60%.
Cloudy skies. Low 2C. Winds ENE at 10 to 15 km/h.
Partly cloudy skies. High 6C. Winds light and variable.
A mostly clear sky. Low -1C. Winds light and variable.
A mainly sunny sky. High 6C. Winds light and variable.
A mostly clear sky. Low near 0C. Winds light and variable.
and my goal is to extract the temperature value into a new field FORECAST_C. I basically have to remove everything up until the space between the date, and everything after starting with "C.". My desired output is:
FORECAST_C
13
4
10
2
6
-1
6
0
I've come up with
rex field=entry ".\s(<FORECAST_C>.*)C\w."
but it's clearly not working...
Can somebody give me a hand?
Thanks!
Andrew
If every line is an event try this:
your query to return event
| rex field=_raw ".*\s(?<FORECAST_C>\-*[\d]+)C\..*"
| table FORECAST_C
If more than one lines are in per event try max_match=0
in it:
your query to return event
| rex max_match=0 field=_raw ".*\s(?<FORECAST_C>\-*[\d]+)C\..*"
| table FORECAST_C
If the data in question is in field=entry
then you can use that field as well in the above commands rather than field=_raw
.
If every line is an event try this:
your query to return event
| rex field=_raw ".*\s(?<FORECAST_C>\-*[\d]+)C\..*"
| table FORECAST_C
If more than one lines are in per event try max_match=0
in it:
your query to return event
| rex max_match=0 field=_raw ".*\s(?<FORECAST_C>\-*[\d]+)C\..*"
| table FORECAST_C
If the data in question is in field=entry
then you can use that field as well in the above commands rather than field=_raw
.
Exactly that! I saw that you revised your answer since I was about to say that I added the \s so that it would take everything after the space, but I see you caught that already!
Thank you!