I need to extract the first 4 words in a field with sample data like this,
"The team performs checks for the following dashboards".
What I want is to extract the first 4 words, like so,
"The team performs checks".
rex field=long_description ^(?<field1>\w+\s\d+)
I've made a rex command that will extract the first word. However, I'm having difficulty figuring out how to extract the first 4 words.
Can anybody please help me out?
Hi @dojiepreji
Please try
| makeresults
| eval sample="The team performs checks for the following dashboards"
| rex field=sample "(?P<output>(?:\S+\s){3}\S*).*"
Hi @dojiepreji
Please try
| makeresults
| eval sample="The team performs checks for the following dashboards"
| rex field=sample "(?P<output>(?:\S+\s){3}\S*).*"
Do you want the first 4 words in a single field or multiple fields. @saurabhkharkar's answer will put them into a single field. To get them in multiple fields, try this.
| rex field=long_description "(?<word1>\w+)\W+(?<word2>\w+)\W+(?<word3>\w+)\W+(?<word4>\w+)"
|makeresults
|eval string="The team performs checks for the following dashboards"
| rex field=string "(?<output>\w+\s+\w+\s+\w+\s+\w+).+"