Hello all,
I have a problem extracting field using regex. The nearest query I've made is:
index=* | rex field=_raw "/application/(?<type>[\S+]+)" | stats count by type
However, the result extracted comes with a comma at the end. Example of result is
toy1,
/store/toy2,
/store/US/toy4,
What should I do to remove the comma ( , ) from the result?
Thanks.
try this rex:
index=* |rex "/application/(?<type>[^,]+)"
Thank you, it works!