Hi - I need to extract two multivalue fields from each event. Let's say the strings are "AAA-" and "BBB-". Each string is followed by a number after the hyphen. An event will have one or both of these strings and possibly multiples of each, hence multivalue. I can pipe the search to a rex command (e.g. |rex max_match=0 "(?AAA-[0-9]+)"
) which gets me the multivalues of AAA- for each event but how can I include BBB- if it exists in the event as well, or vice versa ?
Thanks,
W
If you want use rex to match either of two strings, use a '|'. This string should match either "AAA-1" or "BBB-1".
| rex max_match=0 "(?<foo>(?:AAA|BBB)-[0-9]+)"
You can use regex101.com to test possible regex strings against sample data.
If you want use rex to match either of two strings, use a '|'. This string should match either "AAA-1" or "BBB-1".
| rex max_match=0 "(?<foo>(?:AAA|BBB)-[0-9]+)"
You can use regex101.com to test possible regex strings against sample data.
Brilliant! I was trying to get two multivalue fields extracted but no reason they can't be in one field in this case. Great idea! Thank you.
If your problem is solved, please accept the answer to help future readers.