I think we may need regex for this and I am not good at it.
I need to be able to extract the last part i.e. (TMNT-1752) from the below string . In some cases the numeric part could be three or more digits too like CMNU-112 or NT=1223 etc or TURC-12223. I think I want the part that comes after selectedIssue=.
https://phut.mayhem.com/secure/JapidJoard.jspa?rapidView=12339&view=detail&selectedIssue=TMNT-1752
Hi,
Can you try this :
| rex field=url "selected\w+=(?<value>(([^\&]+)|(.+)))"
OR
| rex field=_raw "selected\w+=(?<value>(([^\&]+)|(.+)))"
Hi @,
I think the regex above should work for you but still if it's not you can try below regex.
index=xyz | rex field=url "\"(selected\w+)\"[=]*(?P(([^&]+)|(.+)))\""
Hi,
Can you try this :
| rex field=url "selected\w+=(?<value>(([^\&]+)|(.+)))"
OR
| rex field=_raw "selected\w+=(?<value>(([^\&]+)|(.+)))"
Thanks @p_gurav
Welcome. 🙂
Hi man,
This should work for you :
| rex field=url "selectedIssue\=(?<value>[^\&]+)"
Best regards,
David
What if the string I am looking for is between "selected=" and "&"
example : selectedIssue=TWNT1752&
selectedDefect=TMNT1752
selectedGarfi=TMNT1234
selectedEpic=TMNT1234
How do I extract it ?
Ah from what I read I saw you needed selected issue only.
Simplest form is:
| rex field=url "selected\w+=(?<value>[^\&]+)"
Hi zacksoft,
In example string is "pelectedIkkue=" constant? If yes then you can try below one:
| rex field=_raw "selectedIssue\=(?P<field1>.+)"
If I try this , where will it extract TMNT-1752 to ?
I need to able to use the value and put it in a table.
it will extract into "field1".. which you can use in the search
@p_gurav
Actually it's not _raw. The entire string itself is stored in a field caleld "url".
What changes do I make for that ?
Then used below:
| rex field=url "selectedIssue\=(?P<field1>.+)"
A small change ... I see in some of the strings there are some values that are present after TMNT-1752 and they begin with '&' and that messes up the extract. Can I filter those ?
The current query's output is "TMNT-1752&myReq=1234somethingsomething"
Can we just get the part present between "selectedIssue=" and "&"
Then try this, It will create field called value
which you can use in search:
| rex field=url "selectedIssue\=(?<value>(([^\&]+)|(.+)))"
OR
| rex field=_raw "selectedIssue\=(?<value>(([^\&]+)|(.+)))"
Yes, that is constant. The only value that changes is 'TMNT-1752'. It could be something like ABC-1233 or ABFD-121 etc...
Hi @zacksoft,
Please try <yourBasesearch> | rex ".*=(?<value>.*)"
this will extract TMNT-1752
into new field value
Here is run anywhere search, first 2 lines generating dummy data only.
| makeresults
| eval _raw="https://phut.mayhem.com/secure/JapidJoard.jspa?rapidView=12339&view=detail&pelectedIkkue=TMNT-1752"
| rex ".*=(?<value>.*)"
There is another "=" sign before "rapidView". But I don't want that value. I only want the last one that comes after 'selectedIssue='
Can you please post your full event instead of part of event so that we can write regex properly.
The string itself is extracted from _raw and stored in a field called 'url'.
And url field is as follows. I need the string that is present after 'selectedIssue='
https://phut.mayhem.com/secure/JapidJoard.jspa?rapidView=12339&view=detail&selectedIssue=TMNT-1752"