How to extract URI following rex command?
My field
URI=/v4/cp/members/summary?hcid=
AN5635356
&firstnm=ELLEN&lastnm=BRODBINE&dob=1962-01-02
My rex command :
| rex field=_raw "URI=/v4/cp/members/summary?(?[^ ]*)"
?hcid=AN5635356&firstnm=ELLEN&lastnm=BRODBINE&dob=1962-01-02
Expected output:
AN5635356
Try this,
| makeresults
| eval data="URI=/v4/cp/members/summary?hcid=AN5635356&firstnm=ELLEN&lastnm=BRODBINE&dob=1962-01-02"
| rename data as _raw
| rex field=_raw "hcid\=(?P<OUTPUT>[^\&]*)"
You need to escape special characters such as /
and ?
Try URI=\/v4\/cp\/members\/summary\?hcid=(?P<hcid>[^&]+)
The value will be stored in field hcid